October 2013 - DVDnav-discuss - lists.mplayerhq.hu

r1261 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:21:29 2013 New Revision: 1261 Log: This is a heuristic to prevent segfaults when ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc is invalid but non-NULL. Patch by Fabian Keil #fk$fabiankeil%de^ Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Fri Oct 4 00:19:25 2013 (r1260) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 00:21:29 2013 (r1261) @@ -616,6 +616,10 @@ uint32_t dvdnav_describe_title_chapters( length = 0; for(i=0; i<parts; i++) { uint32_t cellnr, endcellnr; + if (ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc_start_byte >= ifo->vts_pgcit->last_byte) { + printerr("PGC start out of bounds"); + continue; + } pgc = ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc; if (pgc == NULL) { printerr("PGC missing.");

1 0

r1260 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:19:25 2013 New Revision: 1260 Log: Prevent segmentation faults in vdnav_describe_title_chapters() in case of parts with missing PGC. Patch by Fabian Keil !fk#fabiankeil$de% Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Fri Oct 4 00:10:07 2013 (r1259) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 00:19:25 2013 (r1260) @@ -617,6 +617,10 @@ uint32_t dvdnav_describe_title_chapters( for(i=0; i<parts; i++) { uint32_t cellnr, endcellnr; pgc = ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc; + if (pgc == NULL) { + printerr("PGC missing."); + continue; + } if(ptt[i].pgn > pgc->nr_of_programs) { printerr("WRONG part number."); goto fail;

1 0

r1259 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:10:07 2013 New Revision: 1259 Log: Fix crash when trying to play a DVD from different region than currently set in the DVD drive. Patch by Erik Hovland *erik#hovland$.org! based on a patch by Sylvain Henry %hsyl20^gmail&com*. Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Thu Oct 3 23:57:48 2013 (r1258) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 00:10:07 2013 (r1259) @@ -622,7 +622,11 @@ uint32_t dvdnav_describe_title_chapters( goto fail; } - cellnr = pgc->program_map[ptt[i].pgn-1]; + if ((cellnr = pgc->program_map[ptt[i].pgn-1]) == 0) { + printerr("Cell new row cannot be 0"); + continue; + } + if(ptt[i].pgn < pgc->nr_of_programs) endcellnr = pgc->program_map[ptt[i].pgn]; else

1 0

r1258 - trunk/libdvdread/src/ifo_read.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Thu Oct 3 23:57:48 2013 New Revision: 1258 Log: If the start offset points past the last_byte (outside the region read) stop reading PTTs and adjust nr_of_srpts. Fixes Transformers 3 and Cars 2. Patch by John Stebbins ^stebbins*jetheaddev+com/ Modified: trunk/libdvdread/src/ifo_read.c Modified: trunk/libdvdread/src/ifo_read.c ============================================================================== --- trunk/libdvdread/src/ifo_read.c Sun Apr 28 21:10:07 2013 (r1257) +++ trunk/libdvdread/src/ifo_read.c Thu Oct 3 23:57:48 2013 (r1258) @@ -1185,7 +1185,15 @@ int ifoRead_VTS_PTT_SRPT(ifo_handle_t *i goto fail; } for(i = 0; i < vts_ptt_srpt->nr_of_srpts; i++) { - B2N_32(data[i]); + /* Transformers 3 has PTT start bytes that point outside the SRPT PTT */ + uint32_t start = data[i]; + B2N_32(start); + if(start + sizeof(ptt_info_t) > vts_ptt_srpt->last_byte + 1) { + /* don't mess with any bytes beyond the end of the allocation */ + vts_ptt_srpt->nr_of_srpts = i; + break; + } + data[i] = start; /* assert(data[i] + sizeof(ptt_info_t) <= vts_ptt_srpt->last_byte + 1); Magic Knight Rayearth Daybreak is mastered very strange and has Titles with 0 PTTs. They all have a data[i] offsets beyond the end of

1 0