diff options
| -rw-r--r-- | libavcodec/pgssubdec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c index bbcbad014c..d1be074138 100644 --- a/libavcodec/pgssubdec.c +++ b/libavcodec/pgssubdec.c @@ -380,6 +380,7 @@ static int parse_presentation_segment(AVCodecContext *avctx, { PGSSubContext *ctx = avctx->priv_data; int i, state, ret; + const uint8_t *buf_end = buf + buf_size; // Video descriptor int w = bytestream_get_be16(&buf); @@ -433,6 +434,13 @@ static int parse_presentation_segment(AVCodecContext *avctx, for (i = 0; i < ctx->presentation.object_count; i++) { + + if (buf_end - buf < 8) { + av_log(avctx, AV_LOG_ERROR, "Insufficent space for object\n"); + ctx->presentation.object_count = i; + return AVERROR_INVALIDDATA; + } + ctx->presentation.objects[i].id = bytestream_get_be16(&buf); ctx->presentation.objects[i].window_id = bytestream_get_byte(&buf); ctx->presentation.objects[i].composition_flag = bytestream_get_byte(&buf); |