From 7c06aea6f0d26dd70c94ccba6127059cd0a0e352 Mon Sep 17 00:00:00 2001 From: Ruk Doe Date: Sat, 10 Oct 2026 12:04:49 +0900 Subject: [PATCH] avcodec/libaribcaption: allocate one rect in text mode aribcaption_trans_text_subtitle() always fills exactly one rect, but allocated the rects array with ctx->caption.region_count entries. For a caption without regions, such as a clear screen, that is a zero-sized allocation, and writing sub->rects[0] goes past its end. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01DdDiDRusmi6eD7qSrKBjHb Found-by: Joshua Rogers --- libavcodec/libaribcaption.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/libaribcaption.c b/libavcodec/libaribcaption.c index 03deca7a8b..9bad475f57 100644 --- a/libavcodec/libaribcaption.c +++ b/libavcodec/libaribcaption.c @@ -814,7 +814,7 @@ static int aribcaption_trans_text_subtitle(ARIBCaptionContext *ctx) int ret = 0; const char *text; - sub->rects = av_calloc(ctx->caption.region_count, sizeof(*sub->rects)); + sub->rects = av_calloc(1, sizeof(*sub->rects)); if (!sub->rects) { ret = AVERROR(ENOMEM); goto fail;