Re: [DVDnav-discuss] [PATCH] Check for out-of-bounds values for pgcn.
Admittedly, this just papers over the real issue, and I'd appreciate advice on better ways to fix this. There is a sample IFO on the referenced bug report that reproduces the crash. Essentially, we're seeing pgcn values in the 30,000-32,000 range which is outside the bounds of the ifo->vts_pgcit->pgci_srp array, and thus crashes. I haven't found where these large values come from... suggestions for further study would be welcomed. Bryce On Mon, May 06, 2013 at 12:43:59PM -0700, Bryce Harrington wrote:
Fixes a crash in dvdnav_describe_title_chapters() with vlc, lsdvd, and other video players caused by an invalid value for pgcn. This occurs with the "Inside Man" DVD.
Ref: https://bugs.launchpad.net/ubuntu/+source/libdvdnav/+bug/1094499
Signed-off-by: Bryce Harrington <bryce@canonical.com> --- src/searching.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/src/searching.c b/src/searching.c index a9b4dc9..86d4d97 100644 --- a/src/searching.c +++ b/src/searching.c @@ -641,6 +641,11 @@ uint32_t dvdnav_describe_title_chapters(dvdnav_t *this, int32_t title, uint64_t length = 0; for(i=0; i<parts; i++) { uint32_t cellnr, endcellnr; + /* This mimics pgcn checks in ifoRead_VTS_PTT_SRPT() */ + if (ptt[i].pgcn > 1000 || ptt[i].pgcn < 0) { + printerr("PGCN out of bounds."); + continue; + } if (ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc_start_byte >= ifo->vts_pgcit->last_byte) { printerr("PGC start out of bounds"); continue; -- 1.7.9.5
----- End forwarded message -----
Hello Bryce, On Monday, 06 May 2013 at 22:09, Bryce Harrington wrote:
Admittedly, this just papers over the real issue, and I'd appreciate advice on better ways to fix this. There is a sample IFO on the referenced bug report that reproduces the crash. Essentially, we're seeing pgcn values in the 30,000-32,000 range which is outside the bounds of the ifo->vts_pgcit->pgci_srp array, and thus crashes. I haven't found where these large values come from... suggestions for further study would be welcomed.
Could you try this patch instead? pgcn is unsigned, so checking for < 0 doesn't make sense. Index: libdvdnav/src/searching.c =================================================================== --- libdvdnav/src/searching.c (revision 1279) +++ libdvdnav/src/searching.c (working copy) @@ -616,6 +616,10 @@ length = 0; for(i=0; i<parts; i++) { uint32_t cellnr, endcellnr; + if (ptt[i].pgcn == 0 || ptt[i].pgcn > ifo->vts_pgcit->nr_of_pgci_srp) { + printerr("PGCN out of bounds."); + continue; + } if (ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc_start_byte >= ifo->vts_pgcit->last_byte) { printerr("PGC start out of bounds"); continue; Regards, Dominik -- Fedora http://fedoraproject.org/wiki/User:Rathann RPMFusion http://rpmfusion.org | MPlayer http://mplayerhq.hu "Faith manages." -- Delenn to Lennier in Babylon 5:"Confessions and Lamentations"
On Monday, 06 May 2013 at 22:09, Bryce Harrington wrote:
Admittedly, this just papers over the real issue, and I'd appreciate advice on better ways to fix this. There is a sample IFO on the referenced bug report that reproduces the crash. Essentially, we're seeing pgcn values in the 30,000-32,000 range which is outside the bounds of the ifo->vts_pgcit->pgci_srp array, and thus crashes. I haven't found where these large values come from... suggestions for further study would be welcomed.
(Hopefully) fixed in a better way in r1284. Please verify if possible. Regards, Dominik -- Fedora http://fedoraproject.org/wiki/User:Rathann RPMFusion http://rpmfusion.org | MPlayer http://mplayerhq.hu "Faith manages." -- Delenn to Lennier in Babylon 5:"Confessions and Lamentations"
On Tue, Nov 12, 2013 at 02:00:12AM +0100, Dominik 'Rathann' Mierzejewski wrote:
On Monday, 06 May 2013 at 22:09, Bryce Harrington wrote:
Admittedly, this just papers over the real issue, and I'd appreciate advice on better ways to fix this. There is a sample IFO on the referenced bug report that reproduces the crash. Essentially, we're seeing pgcn values in the 30,000-32,000 range which is outside the bounds of the ifo->vts_pgcit->pgci_srp array, and thus crashes. I haven't found where these large values come from... suggestions for further study would be welcomed.
(Hopefully) fixed in a better way in r1284. Please verify if possible.
Thanks, I don't have the DVD to re-test this, but the committed changes look sensible. Bryce
participants (3)
-
Bryce Harrington -
Bryce Harrington -
Dominik 'Rathann' Mierzejewski