[FFmpeg-devel] [PATCH] Decode PGS subtitle multipacket RLE data

[Reimar Döffinger]

On Sat, Nov 06, 2010 at 03:10:55PM -0700, Mark Goodman wrote:
> On Sat, Nov 6, 2010 at 2:55 PM, Reimar D?ffinger
> <Reimar.Doeffinger at gmx.de> wrote:
> > On Sat, Nov 06, 2010 at 02:32:33PM -0700, Mark Goodman wrote:
> >> The width and height bytes are included in the encoded length so
> >> subtract four bytes from the encoded length.
> >
> > There is not enough validation.
> > The decoder is already really crappy in that regard, but the code
> > really needs to check that it has all necessary data upon display
> > (or whenever else it uses it) and at the very least print an error
> > message if not.
> 
> Here's a second patch with some validation.

I suspect this
> if (ctx->picture.rle_actual_len + buf_size > ctx->picture.rle_expected_len)
should be
> if (buf_size > ctx->picture.rle_expected_len ||
>     ctx->picture.rle_actual_len + buf_size > ctx->picture.rle_expected_len)
or something like that to make 100% sure no integer overflow can happen.