diff options
| author | wm4 <nfxjfg@googlemail.com> | 2015-09-21 18:16:35 +0200 |
|---|---|---|
| committer | wm4 <nfxjfg@googlemail.com> | 2015-09-22 17:41:01 +0200 |
| commit | f874e2728b0925b2ec30dd7ec64815f15078c06f (patch) | |
| tree | daa8a5f789d6d77f0f7c2b30c08dbd43e29d6a3d /libavcodec/dvdsubdec.c | |
| parent | 26eb2940079d0ec433cf9b2deae24560707cbcf8 (diff) | |
| download | ffmpeg-f874e2728b0925b2ec30dd7ec64815f15078c06f.tar.gz | |
avcodec/dvdsub: fix partial packet assembly
Assuming the first and second packets are partial, this would append the
reassembly buffer (ctx->buf) to itself with the second
append_to_cached_buf() call, because buf is set to ctx->buf.
I do not know a valid sample file which triggers this, and do not know
if packets can be split into more than 2 sub-packets, but it triggered
with a (differently) broken sample file in trac issue #4872.
Diffstat (limited to 'libavcodec/dvdsubdec.c')
| -rw-r--r-- | libavcodec/dvdsubdec.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 81432e13a6..57eafbf270 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -535,6 +535,7 @@ static int dvdsub_decode(AVCodecContext *avctx, const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; AVSubtitle *sub = data; + int appended = 0; int is_menu; if (ctx->buf_size) { @@ -545,12 +546,13 @@ static int dvdsub_decode(AVCodecContext *avctx, } buf = ctx->buf; buf_size = ctx->buf_size; + appended = 1; } is_menu = decode_dvd_subtitles(ctx, sub, buf, buf_size); if (is_menu == AVERROR(EAGAIN)) { *data_size = 0; - return append_to_cached_buf(avctx, buf, buf_size); + return appended ? 0 : append_to_cached_buf(avctx, buf, buf_size); } if (is_menu < 0) { |