GithubStar/mpv
1
0
Fork 0
mirror of https://github.com/mpv-player/mpv.git synced 2026-10-28 23:13:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make sure we do not read beyond end of subtitle packet

Browse Source 
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@20510 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
reimar
2006-10-29 13:17:26 +00:00
parent 64e9d8fc97
commit ec9819db2c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libmpdemux/demux_ogg.c
+5 -1
View File
@@ -231,6 +231,8 @@ void demux_ogg_add_sub (ogg_stream_t* os,ogg_packet* pack) {
int ignoring = 0;
char *packet = pack->packet;
if (pack->bytes < 4)
return;
mp_msg(MSGT_DEMUX,MSGL_DBG2,"\ndemux_ogg_add_sub %02X %02X %02X '%s'\n",
(unsigned char)packet[0],
(unsigned char)packet[1],
@@ -244,6 +246,8 @@ void demux_ogg_add_sub (ogg_stream_t* os,ogg_packet* pack) {
int16_t hdrlen = (*packet & PACKET_LEN_BITS01)>>6, i;
hdrlen |= (*packet & PACKET_LEN_BITS2) <<1;
lcv = 1 + hdrlen;
if (pack->bytes < lcv)
return;
for (i = hdrlen; i > 0; i--) {
duration <<= 8;
duration |= (unsigned char)packet[i];
@@ -257,7 +261,7 @@ void demux_ogg_add_sub (ogg_stream_t* os,ogg_packet* pack) {
}
ogg_sub.text[0] = realloc(ogg_sub.text[0], OGG_SUB_MAX_LINE);
while (1) {
int c = packet[lcv++];
int c = lcv < pack->bytes ? packet[lcv++] : 0;
if(c=='\n' || c==0 || line_pos >= OGG_SUB_MAX_LINE-1){
ogg_sub.text[ogg_sub.lines][line_pos] = 0; // close sub
if(line_pos) {