[DVDnav-discuss] [PATCH] Check for out-of-bounds values for pgcn.

[Bryce Harrington]

Fixes a crash in dvdnav_describe_title_chapters() with vlc, lsdvd, and
other video players caused by an invalid value for pgcn.  This occurs
with the "Inside Man" DVD.

Ref: https://bugs.launchpad.net/ubuntu/+source/libdvdnav/+bug/1094499

Signed-off-by: Bryce Harrington <bryce at canonical.com>
---
 src/searching.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/searching.c b/src/searching.c
index a9b4dc9..86d4d97 100644
--- a/src/searching.c
+++ b/src/searching.c
@@ -641,6 +641,11 @@ uint32_t dvdnav_describe_title_chapters(dvdnav_t *this, int32_t title, uint64_t
   length = 0;
   for(i=0; i<parts; i++) {
     uint32_t cellnr, endcellnr;
+    /* This mimics pgcn checks in ifoRead_VTS_PTT_SRPT() */
+    if (ptt[i].pgcn > 1000 || ptt[i].pgcn < 0) {
+      printerr("PGCN out of bounds.");
+      continue;
+    }
     if (ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc_start_byte >= ifo->vts_pgcit->last_byte) {
       printerr("PGC start out of bounds");
       continue;
-- 
1.7.9.5