PR #23657 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657.patch
Fixes: heap buffer overflow Fixes: lqaO5R1BaZGO Fixes: dbfe61100b (avformat/vobsub: fix several issues.) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> >From 47e2a6e6eb32e12bd9e04d7c662b30da28b97b8c Mon Sep 17 00:00:00 2001 From: Pavel Kohout <[email protected]> Date: Mon, 29 Jun 2026 23:30:41 +0200 Subject: [PATCH] avformat/vobsub: reuse subtitle streams and bound the stream count Fixes: heap buffer overflow Fixes: lqaO5R1BaZGO Fixes: dbfe61100b (avformat/vobsub: fix several issues.) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpeg.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index ff5ced8107..29abe329b9 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -841,6 +841,20 @@ static int vobsub_read_header(AVFormatContext *s) } if (!st || st->id != stream_id) { + st = NULL; + for (i = 0; i < s->nb_streams; i++) { + if (s->streams[i]->id == stream_id) { + st = s->streams[i]; + break; + } + } + } + if (!st) { + if (s->nb_streams >= FF_ARRAY_ELEMS(vobsub->q)) { + av_log(s, AV_LOG_ERROR, "Maximum number of subtitle streams reached\n"); + ret = AVERROR_INVALIDDATA; + goto end; + } st = avformat_new_stream(s, NULL); if (!st) { ret = AVERROR(ENOMEM); @@ -865,14 +879,14 @@ static int vobsub_read_header(AVFormatContext *s) timestamp = (hh*3600LL + mm*60LL + ss) * 1000LL + ms + delay; timestamp = av_rescale_q(timestamp, av_make_q(1, 1000), st->time_base); - sub = ff_subtitles_queue_insert(&vobsub->q[s->nb_streams - 1], "", 0, 0); + sub = ff_subtitles_queue_insert(&vobsub->q[st->index], "", 0, 0); if (!sub) { ret = AVERROR(ENOMEM); goto end; } sub->pos = pos; sub->pts = timestamp; - sub->stream_index = s->nb_streams - 1; + sub->stream_index = st->index; } else if (!strncmp(line, "alt:", 4)) { const char *p = line + 4; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
