This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 5d4d3bdc61 avcodec/pgssubdec: always give an output rect a palette
5d4d3bdc61 is described below
commit 5d4d3bdc61412641883a45e060e810f80ea7f4b5
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 06:03:39 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Fri Jul 31 13:34:50 2026 +0000
avcodec/pgssubdec: always give an output rect a palette
Fixes: NULL pointer dereference
Fixes: poc_null_deref.sup
Fixes: Fobbab5Vtlr3
Found-by: VRI with 图龙锋
---
libavcodec/pgssubdec.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c
index 20583c9afa..3a4b60f419 100644
--- a/libavcodec/pgssubdec.c
+++ b/libavcodec/pgssubdec.c
@@ -537,6 +537,16 @@ static int display_end_segment(AVCodecContext *avctx,
AVSubtitle *sub,
sub->rects[sub->num_rects++] = rect;
rect->type = SUBTITLE_BITMAP;
+ /* Allocate the palette now so that the error paths below, which
+ * leave the rect empty, still hand consumers a complete bitmap
+ * rect rather than one with a NULL palette. */
+ rect->nb_colors = 256;
+ rect->data[1] = av_mallocz(AVPALETTE_SIZE);
+ if (!rect->data[1])
+ return AVERROR(ENOMEM);
+ if (!ctx->forced_subs_only ||
ctx->presentation.objects[i].composition_flag & 0x40)
+ memcpy(rect->data[1], palette->clut, rect->nb_colors *
sizeof(uint32_t));
+
/* Process bitmap */
object = find_object(ctx->presentation.objects[i].id, &ctx->objects);
if (!object) {
@@ -577,14 +587,6 @@ static int display_end_segment(AVCodecContext *avctx,
AVSubtitle *sub,
continue;
}
}
- /* Allocate memory for colors */
- rect->nb_colors = 256;
- rect->data[1] = av_mallocz(AVPALETTE_SIZE);
- if (!rect->data[1])
- return AVERROR(ENOMEM);
-
- if (!ctx->forced_subs_only ||
ctx->presentation.objects[i].composition_flag & 0x40)
- memcpy(rect->data[1], palette->clut, rect->nb_colors *
sizeof(uint32_t));
}
return 1;
}
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
