PR #24486 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24486 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24486.patch
Fixes: m46RwJIzh7AQ Fixes: out of array write Found-by: Zheng Yu @ Depthfirst >From b27f547de33d695f8f077b64b6405c34f2b7ca28 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 14 Sep 2026 02:23:52 +0200 Subject: [PATCH] avcodec/dvdsubenc: account for the byte alignment of each RLE line Fixes: m46RwJIzh7AQ Fixes: out of array write Found-by: Zheng Yu @ Depthfirst --- libavcodec/dvdsubenc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dvdsubenc.c b/libavcodec/dvdsubenc.c index 2a5463b8d8..0747c43c31 100644 --- a/libavcodec/dvdsubenc.c +++ b/libavcodec/dvdsubenc.c @@ -340,8 +340,8 @@ static int dvdsub_encode(AVCodecContext *avctx, // encode data block q = outbuf + 4; offset1 = q - outbuf; - // worst case memory requirement: 1 nibble per pixel.. - if ((q - outbuf) + vrect.w * vrect.h / 2 + 17 + 21 > outbuf_size) { + // worst case memory requirement: 1 nibble per pixel, lines are byte aligned + if ((q - outbuf) + vrect.h * ((vrect.w + 1) / 2) + 17 + 21 > outbuf_size) { av_log(NULL, AV_LOG_ERROR, "dvd_subtitle too big\n"); ret = AVERROR_BUFFER_TOO_SMALL; goto fail; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
