From 10bcc915535e1e474016a7841f986a3959e17b00 Mon Sep 17 00:00:00 2001 From: Maintainers of GStreamer packages Date: Sun, 26 Nov 2023 22:55:02 +0200 Subject: [PATCH] SA-2023-0003 Gbp-Pq: Name SA-2023-0003.patch --- gst/dvdspu/gstspu-pgs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/gst/dvdspu/gstspu-pgs.c b/gst/dvdspu/gstspu-pgs.c index 6108de0..df0b8e2 100644 --- a/gst/dvdspu/gstspu-pgs.c +++ b/gst/dvdspu/gstspu-pgs.c @@ -593,6 +593,9 @@ parse_set_object_data (GstDVDSpu * dvdspu, guint8 type, guint8 * payload, obj->rle_data_size = GST_READ_UINT24_BE (payload); payload += 3; + if (end - payload > obj->rle_data_size) + return 0; + PGS_DUMP ("%d bytes of RLE data, of %d bytes total.\n", (int) (end - payload), obj->rle_data_size); @@ -604,7 +607,8 @@ parse_set_object_data (GstDVDSpu * dvdspu, guint8 type, guint8 * payload, PGS_DUMP ("%d bytes of additional RLE data\n", (int) (end - payload)); /* Check that the data chunk is for this object version, and fits in the buffer */ if (obj->rle_data_ver == obj_ver && - obj->rle_data_used + end - payload <= obj->rle_data_size) { + end - payload <= obj->rle_data_size && + obj->rle_data_used <= obj->rle_data_size - (end - payload)) { memcpy (obj->rle_data + obj->rle_data_used, payload, end - payload); obj->rle_data_used += end - payload; -- 2.30.2