From 0710198038383d136a8ee5dee65f7f487cc133ba Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 22 Jul 2026 06:03:39 +0200 Subject: [PATCH] avcodec/pgssubdec: always give an output rect a palette MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: NULL pointer dereference Fixes: poc_null_deref.sup Fixes: Fobbab5Vtlr3 Found-by: VRI with 图龙锋 (cherry picked from commit 5d4d3bdc61412641883a45e060e810f80ea7f4b5) Signed-off-by: Michael Niedermayer --- libavcodec/pgssubdec.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c index 20583c9afa..3a4b60f419 100644 --- a/libavcodec/pgssubdec.c +++ b/libavcodec/pgssubdec.c @@ -537,6 +537,16 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub, sub->rects[sub->num_rects++] = rect; rect->type = SUBTITLE_BITMAP; + /* Allocate the palette now so that the error paths below, which + * leave the rect empty, still hand consumers a complete bitmap + * rect rather than one with a NULL palette. */ + rect->nb_colors = 256; + rect->data[1] = av_mallocz(AVPALETTE_SIZE); + if (!rect->data[1]) + return AVERROR(ENOMEM); + if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40) + memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t)); + /* Process bitmap */ object = find_object(ctx->presentation.objects[i].id, &ctx->objects); if (!object) { @@ -577,14 +587,6 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub, continue; } } - /* Allocate memory for colors */ - rect->nb_colors = 256; - rect->data[1] = av_mallocz(AVPALETTE_SIZE); - if (!rect->data[1]) - return AVERROR(ENOMEM); - - if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40) - memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t)); } return 1; }