dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 17:39:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/pgssubdec: always give an output rect a palette

Browse Source 
Fixes: NULL pointer dereference
Fixes: poc_null_deref.sup
Fixes: Fobbab5Vtlr3
Found-by: VRI with 图龙锋
(cherry picked from commit 5d4d3bdc61)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-22 06:03:39 +02:00
parent 90243e3985
commit 0710198038
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libavcodec/pgssubdec.c
View File

@@ -537,6 +537,16 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub,
sub->rects[sub->num_rects++] = rect;
rect->type = SUBTITLE_BITMAP;
/* Allocate the palette now so that the error paths below, which
* leave the rect empty, still hand consumers a complete bitmap
* rect rather than one with a NULL palette. */
rect->nb_colors = 256;
rect->data[1] = av_mallocz(AVPALETTE_SIZE);
if (!rect->data[1])
return AVERROR(ENOMEM);
if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40)
memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t));
/* Process bitmap */
object = find_object(ctx->presentation.objects[i].id, &ctx->objects);
if (!object) {
@@ -577,14 +587,6 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub,
continue;
}
}
/* Allocate memory for colors */
rect->nb_colors = 256;
rect->data[1] = av_mallocz(AVPALETTE_SIZE);
if (!rect->data[1])
return AVERROR(ENOMEM);
if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40)
memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t));
}
return 1;
}