diff options
| author | Jan Schmidt <jan@centricular.com> | 2014-04-09 00:44:08 +1000 |
|---|---|---|
| committer | Jan Schmidt <jan@centricular.com> | 2014-04-09 01:10:21 +1000 |
| commit | 982104d764ab3c8d7efa8b5c003c6fa5a173a4a1 (patch) | |
| tree | 44446de2b15ef832b29b2f933550470b1d026843 /gst | |
| parent | d576a7b5ebe0a252d0577ad4d4981e0d48bd413f (diff) | |
| download | gstreamer-plugins-bad-982104d764ab3c8d7efa8b5c003c6fa5a173a4a1.tar.gz | |
dvbsuboverlay: Avoid infinite loops on short data
Diffstat (limited to 'gst')
| -rw-r--r-- | gst/dvbsuboverlay/dvb-sub.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/gst/dvbsuboverlay/dvb-sub.c b/gst/dvbsuboverlay/dvb-sub.c index 00d43b4d3..ae3ab6075 100644 --- a/gst/dvbsuboverlay/dvb-sub.c +++ b/gst/dvbsuboverlay/dvb-sub.c @@ -646,7 +646,8 @@ _dvb_sub_read_2bit_string (guint8 * destbuf, gint dbuf_len, GST_TRACE ("dbuf_len = %d", dbuf_len); - while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 0)) { + /* Need at least 2 bits remaining */ + while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 1)) { guint run_length = 0, clut_index = 0; bits = gst_bit_reader_get_bits_uint32_unchecked (&gb, 2); @@ -739,7 +740,8 @@ _dvb_sub_read_4bit_string (guint8 * destbuf, gint dbuf_len, GST_TRACE ("RUNLEN: srcbuf position %p, buf_size = %d; destination buffer " "size is %d @ %p", *srcbuf, buf_size, dbuf_len, destbuf); - while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 0)) { + /* Need at least 4 bits */ + while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 3)) { guint run_length = 0, clut_index = 0; bits = gst_bit_reader_get_bits_uint32_unchecked (&gb, 4); @@ -843,7 +845,7 @@ _dvb_sub_read_8bit_string (guint8 * destbuf, gint dbuf_len, * FFMPEG-FIXME: lest have no chance of reading memory we don't own and visual corruption * FFMPEG-FIXME: is guaranteed anyway when not all bytes are present */ /* Rephrased - it's better to work with bytes with default value '0' instead of reading from memory we don't own. */ - while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 0)) { + while (!stop_parsing && (gst_bit_reader_get_remaining (&gb) > 7)) { guint run_length = 0, clut_index = 0; bits = gst_bit_reader_get_bits_uint32_unchecked (&gb, 8); |