dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/libaribcaption: free only the added rects on ass errors

Browse Source 
The ass error path freed sub->rects[0] .. [region_count - 1], but
ff_ass_add_rect() grows the array one rect at a time and counts the
rects it added in sub->num_rects, including one whose dialog string
failed to allocate. Entries past num_rects are not initialized, so an
allocation failure part way through read them, or past the array.

Free up to sub->num_rects instead.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdDiDRusmi6eD7qSrKBjHb
Reported-by: Forgejo_Fairy
Reference: #24992
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
This commit is contained in:
Ruk DoeandClaude Opus 5.5 authored and michaelni committed 2026-11-06 04:39:07 +00:00
1 parent a7ef46558e
commit 4ec127c826
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/libaribcaption.c
+1 -1
View File
@@ -793,7 +793,7 @@ static int aribcaption_trans_ass_subtitle(ARIBCaptionContext *ctx)
fail:
if (sub->rects) {
for (int i = 0; i < ctx->caption.region_count; i++) {
for (int i = 0; i < sub->num_rects; i++) {
if (sub->rects[i]) {
av_freep(&sub->rects[i]->ass);
av_freep(&sub->rects[i]);