Author: rathann Date: Tue Nov 12 01:55:10 2013 New Revision: 1284 Log: Check for out-of-bounds values for pgcn Fixes a crash in dvdnav_describe_title_chapters() with vlc, lsdvd, and other video players caused by an invalid value for pgcn. This occurs with the "Inside Man" DVD. Based on patches by Bryce Harrington <bryce AT canonical DOT com> and Vincent Mussard <frodon AT wanadoo DOT fr> Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Tue Nov 12 01:10:38 2013 (r1283) +++ trunk/libdvdnav/src/searching.c Tue Nov 12 01:55:10 2013 (r1284) @@ -616,6 +616,10 @@ uint32_t dvdnav_describe_title_chapters( length = 0; for(i=0; i<parts; i++) { uint32_t cellnr, endcellnr; + if (ptt[i].pgcn == 0 || ptt[i].pgcn > ifo->vts_pgcit->nr_of_pgci_srp) { + printerr("PGCN out of bounds."); + continue; + } if (ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc_start_byte >= ifo->vts_pgcit->last_byte) { printerr("PGC start out of bounds"); continue;