avcodec/libaribcaption: allocate one rect in text mode

aribcaption_trans_text_subtitle() always fills exactly one rect, but
allocated the rects array with ctx->caption.region_count entries. For a
caption without regions, such as a clear screen, that is a zero-sized
allocation, and writing sub->rects[0] goes past its end.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdDiDRusmi6eD7qSrKBjHb
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
This commit is contained in:
Ruk DoeandClaude Opus 5.5 authored and michaelni committed 2026-11-06 04:39:07 +00:00
1 parent e3c8e7fbbf
commit 7c06aea6f0
1 file changed
+1 -1
+1 -1
View File
@@ -814,7 +814,7 @@ static int aribcaption_trans_text_subtitle(ARIBCaptionContext *ctx)
int ret = 0;
const char *text;
sub->rects = av_calloc(ctx->caption.region_count, sizeof(*sub->rects));
sub->rects = av_calloc(1, sizeof(*sub->rects));
if (!sub->rects) {
ret = AVERROR(ENOMEM);
goto fail;