PR #25268 opened by sahitya-chandra URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25268 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25268.patch
Check av_dynarray_add() failures when building the font table and derive the ftab size from the final font vector Fixes #24184 >From b432ab9dbdabc373387816618d8884560bb9c80c Mon Sep 17 00:00:00 2001 From: Sahitya Chandra <[email protected]> Date: Wed, 21 Oct 2026 01:46:17 +0530 Subject: [PATCH] avcodec/movtextenc: check font table allocation failures Use av_dynarray_add_nofree() and return ENOMEM on failure, and derive the font name length from the final font vector so the ftab size always matches the records written. Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/24184 Signed-off-by: Sahitya Chandra <[email protected]> --- libavcodec/movtextenc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/libavcodec/movtextenc.c b/libavcodec/movtextenc.c index 589540e115c..c42bd7b8a60 100644 --- a/libavcodec/movtextenc.c +++ b/libavcodec/movtextenc.c @@ -264,8 +264,10 @@ static int encode_sample_description(AVCodecContext *avctx) if (style && ass->styles_count) { // Find unique font names if (style->font_name) { - av_dynarray_add(&s->fonts, &s->font_count, style->font_name); - font_names_total_len += strlen(style->font_name); + ret = av_dynarray_add_nofree(&s->fonts, &s->font_count, + style->font_name); + if (ret < 0) + goto fail; } for (i = 0; i < ass->styles_count; i++) { int found = 0; @@ -278,16 +280,21 @@ static int encode_sample_description(AVCodecContext *avctx) } } if (!found) { - av_dynarray_add(&s->fonts, &s->font_count, - ass->styles[i].font_name); - font_names_total_len += strlen(ass->styles[i].font_name); + ret = av_dynarray_add_nofree(&s->fonts, &s->font_count, + ass->styles[i].font_name); + if (ret < 0) + goto fail; } } } else { - av_dynarray_add(&s->fonts, &s->font_count, (char*)"Serif"); - font_names_total_len = strlen("Serif"); + ret = av_dynarray_add_nofree(&s->fonts, &s->font_count, (char*)"Serif"); + if (ret < 0) + goto fail; } + for (i = 0; i < s->font_count; i++) + font_names_total_len += strlen(s->fonts[i]); + // FontTableBox { p = buf; bytestream_put_be32(&p, SIZE_ADD + 3 * s->font_count + font_names_total_len); // Size -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
