[FFmpeg-devel] [PATCH] Decode PGS subtitle multipacket RLE data

[Reimar Döffinger]

On Sat, Nov 06, 2010 at 03:53:28PM -0700, Mark Goodman wrote:
> On Sat, Nov 6, 2010 at 3:26 PM, Reimar D?ffinger
> <Reimar.Doeffinger at gmx.de> wrote:
> > On Sat, Nov 06, 2010 at 03:10:55PM -0700, Mark Goodman wrote:
> >> On Sat, Nov 6, 2010 at 2:55 PM, Reimar D?ffinger
> >> <Reimar.Doeffinger at gmx.de> wrote:
> >> > On Sat, Nov 06, 2010 at 02:32:33PM -0700, Mark Goodman wrote:
> >> >> The width and height bytes are included in the encoded length so
> >> >> subtract four bytes from the encoded length.
> >> >
> >> > There is not enough validation.
> >> > The decoder is already really crappy in that regard, but the code
> >> > really needs to check that it has all necessary data upon display
> >> > (or whenever else it uses it) and at the very least print an error
> >> > message if not.
> >>
> >> Here's a second patch with some validation.
> >
> > I suspect this
> >> if (ctx->picture.rle_actual_len + buf_size > ctx->picture.rle_expected_len)
> > should be
> >> if (buf_size > ctx->picture.rle_expected_len ||
> >> ? ? ctx->picture.rle_actual_len + buf_size > ctx->picture.rle_expected_len)
> > or something like that to make 100% sure no integer overflow can happen.
> 
> Yes. A third patch is attached.

Applied with some modifications.