Ticket #2432: v1-0001-WIP-XXX-spudec_process_control-Don-t-read-beyond-.patch

File v1-0001-WIP-XXX-spudec_process_control-Don-t-read-beyond-.patch, 2.6 KB (added by beastd, 2 weeks ago)

  • sub/spudec.c 

    From 0532e36c165481134788c89d58c84392d613a9bf Mon Sep 17 00:00:00 2001
From: Alexander Strasser <eclipse7@gmx.net>
Date: Tue, 29 Sep 2026 23:36:19 +0200
Subject: [PATCH v1] WIP: XXX: spudec_process_control: Don't read beyond packet
 boundary

Tickets: #2432
---
 sub/spudec.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/sub/spudec.c b/sub/spudec.c
index 516ce52e6..7ad60e7e6 100644
    a b static void spudec_process_control(spudec_handle_t *this, int pts100)  
    463463  unsigned int height = 0;
    464464  unsigned int stride = 0;
    465465
     466  if (this->packet_size < 4) {
     467    return;
     468  }
    466469  control_start = get_be16(this->packet + 2);
    467470  next_off = control_start;
    468471  while (start_off != next_off) {
     472    if (next_off >= this->packet_size - 3) {
     473      return;
     474    }
    469475    start_off = next_off;
    470476    date = get_be16(this->packet + start_off) * 1024;
    471477    next_off = get_be16(this->packet + start_off + 2);
    472478    mp_msg(MSGT_SPUDEC,MSGL_DBG2, "date=%d\n", date);
    473479    off = start_off + 4;
    474     for (type = this->packet[off++]; type != 0xff; type = this->packet[off++]) {
     480    for (type = this->packet[off++]; off <= this->packet_size && type != 0xff; type = this->packet[off++]) {
    475481      mp_msg(MSGT_SPUDEC,MSGL_DBG2, "cmd=%d  ",type);
    476482      switch(type) {
    477483      case 0x00:
    … … static void spudec_process_control(spudec_handle_t *this, int pts100)  
    498504        break;
    499505      case 0x03:
    500506        /* Palette */
     507        if (off >= this->packet_size - 1) {
     508          return;
     509        }
    501510        this->palette[0] = this->packet[off] >> 4;
    502511        this->palette[1] = this->packet[off] & 0xf;
    503512        this->palette[2] = this->packet[off + 1] >> 4;
    … … static void spudec_process_control(spudec_handle_t *this, int pts100)  
    508517        break;
    509518      case 0x04:
    510519        /* Alpha */
     520        if (off >= this->packet_size - 1) {
     521          return;
     522        }
    511523        a = this->packet[off] >> 4;
    512524        b = this->packet[off] & 0xf;
    513525        c = this->packet[off + 1] >> 4;
    … … static void spudec_process_control(spudec_handle_t *this, int pts100)  
    530542        break;
    531543      case 0x05:
    532544        /* Co-ords */
     545        if (off >= this->packet_size - 5) {
     546          return;
     547        }
    533548        a = get_be24(this->packet + off);
    534549        b = get_be24(this->packet + off + 3);
    535550        start_col = a >> 12;
    … … static void spudec_process_control(spudec_handle_t *this, int pts100)  
    546561        break;
    547562      case 0x06:
    548563        /* Graphic lines */
     564        if (off >= this->packet_size - 3) {
     565          return;
     566        }
    549567        current_nibble[0] = 2 * get_be16(this->packet + off);
    550568        current_nibble[1] = 2 * get_be16(this->packet + off + 2);
    551569        mp_msg(MSGT_SPUDEC,MSGL_DBG2,"Graphic offset 1: %d  offset 2: %d\n",