From 0532e36c165481134788c89d58c84392d613a9bf Mon Sep 17 00:00:00 2001
From: Alexander Strasser <eclipse7@gmx.net>
Date: Tue, 29 Sep 2026 23:36:19 +0200
Subject: [PATCH v1] WIP: XXX: spudec_process_control: Don't read beyond packet
 boundary

Tickets: #2432
---
 sub/spudec.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/sub/spudec.c b/sub/spudec.c
index 516ce52e6..7ad60e7e6 100644
--- a/sub/spudec.c
+++ b/sub/spudec.c
@@ -463,15 +463,21 @@ static void spudec_process_control(spudec_handle_t *this, int pts100)
   unsigned int height = 0;
   unsigned int stride = 0;
 
+  if (this->packet_size < 4) {
+    return;
+  }
   control_start = get_be16(this->packet + 2);
   next_off = control_start;
   while (start_off != next_off) {
+    if (next_off >= this->packet_size - 3) {
+      return;
+    }
     start_off = next_off;
     date = get_be16(this->packet + start_off) * 1024;
     next_off = get_be16(this->packet + start_off + 2);
     mp_msg(MSGT_SPUDEC,MSGL_DBG2, "date=%d\n", date);
     off = start_off + 4;
-    for (type = this->packet[off++]; type != 0xff; type = this->packet[off++]) {
+    for (type = this->packet[off++]; off <= this->packet_size && type != 0xff; type = this->packet[off++]) {
       mp_msg(MSGT_SPUDEC,MSGL_DBG2, "cmd=%d  ",type);
       switch(type) {
       case 0x00:
@@ -498,6 +504,9 @@ static void spudec_process_control(spudec_handle_t *this, int pts100)
 	break;
       case 0x03:
 	/* Palette */
+	if (off >= this->packet_size - 1) {
+	  return;
+	}
 	this->palette[0] = this->packet[off] >> 4;
 	this->palette[1] = this->packet[off] & 0xf;
 	this->palette[2] = this->packet[off + 1] >> 4;
@@ -508,6 +517,9 @@ static void spudec_process_control(spudec_handle_t *this, int pts100)
 	break;
       case 0x04:
 	/* Alpha */
+	if (off >= this->packet_size - 1) {
+	  return;
+	}
 	a = this->packet[off] >> 4;
 	b = this->packet[off] & 0xf;
 	c = this->packet[off + 1] >> 4;
@@ -530,6 +542,9 @@ static void spudec_process_control(spudec_handle_t *this, int pts100)
 	break;
       case 0x05:
 	/* Co-ords */
+	if (off >= this->packet_size - 5) {
+	  return;
+	}
 	a = get_be24(this->packet + off);
 	b = get_be24(this->packet + off + 3);
 	start_col = a >> 12;
@@ -546,6 +561,9 @@ static void spudec_process_control(spudec_handle_t *this, int pts100)
 	break;
       case 0x06:
 	/* Graphic lines */
+	if (off >= this->packet_size - 3) {
+	  return;
+	}
 	current_nibble[0] = 2 * get_be16(this->packet + off);
 	current_nibble[1] = 2 * get_be16(this->packet + off + 2);
 	mp_msg(MSGT_SPUDEC,MSGL_DBG2,"Graphic offset 1: %d  offset 2: %d\n",
--