Ticket #1729: dvbsubdecpatch.txt

File dvbsubdecpatch.txt, 1.9 KB (added by dm@…, 20 years ago)
Line 
1Index: libs/libavcodec/dvbsubdec.c
2===================================================================
3--- libs/libavcodec/dvbsubdec.c (revision 9788)
4+++ libs/libavcodec/dvbsubdec.c (working copy)
5@@ -765,7 +765,7 @@
6 y_pos++;
7
8 while (buf < buf_end) {
9- if (x_pos >= region->width || y_pos >= region->height) {
10+ if (x_pos > region->width || y_pos > region->height) {
11 av_log(avctx, AV_LOG_ERROR, "Invalid object location!\n");
12 return;
13 }
14@@ -779,6 +779,11 @@
15 else
16 map_table = NULL;
17
18+ if (y_pos >= region->height) {
19+ av_log(avctx, AV_LOG_ERROR, "Invalid y position!\n");
20+ return;
21+ }
22+
23 x_pos += dvbsub_read_2bit_string(pbuf + (y_pos * region->width) + x_pos,
24 region->width - x_pos, &buf, buf_size,
25 non_mod, map_table);
26@@ -794,6 +799,11 @@
27 else
28 map_table = NULL;
29
30+ if (y_pos >= region->height) {
31+ av_log(avctx, AV_LOG_ERROR, "Invalid y position!\n");
32+ return;
33+ }
34+
35 x_pos += dvbsub_read_4bit_string(pbuf + (y_pos * region->width) + x_pos,
36 region->width - x_pos, &buf, buf_size,
37 non_mod, map_table);
38@@ -804,6 +814,11 @@
39 return;
40 }
41
42+ if (y_pos >= region->height) {
43+ av_log(avctx, AV_LOG_ERROR, "Invalid y position!\n");
44+ return;
45+ }
46+
47 x_pos += dvbsub_read_8bit_string(pbuf + (y_pos * region->width) + x_pos,
48 region->width - x_pos, &buf, buf_size,
49 non_mod, NULL);