This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 0710198038383d136a8ee5dee65f7f487cc133ba Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 22 06:03:39 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:32 2026 +0200 avcodec/pgssubdec: always give an output rect a palette Fixes: NULL pointer dereference Fixes: poc_null_deref.sup Fixes: Fobbab5Vtlr3 Found-by: VRI with 图龙锋 (cherry picked from commit 5d4d3bdc61412641883a45e060e810f80ea7f4b5) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/pgssubdec.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c index 20583c9afa..3a4b60f419 100644 --- a/libavcodec/pgssubdec.c +++ b/libavcodec/pgssubdec.c @@ -537,6 +537,16 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub, sub->rects[sub->num_rects++] = rect; rect->type = SUBTITLE_BITMAP; + /* Allocate the palette now so that the error paths below, which + * leave the rect empty, still hand consumers a complete bitmap + * rect rather than one with a NULL palette. */ + rect->nb_colors = 256; + rect->data[1] = av_mallocz(AVPALETTE_SIZE); + if (!rect->data[1]) + return AVERROR(ENOMEM); + if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40) + memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t)); + /* Process bitmap */ object = find_object(ctx->presentation.objects[i].id, &ctx->objects); if (!object) { @@ -577,14 +587,6 @@ static int display_end_segment(AVCodecContext *avctx, AVSubtitle *sub, continue; } } - /* Allocate memory for colors */ - rect->nb_colors = 256; - rect->data[1] = av_mallocz(AVPALETTE_SIZE); - if (!rect->data[1]) - return AVERROR(ENOMEM); - - if (!ctx->forced_subs_only || ctx->presentation.objects[i].composition_flag & 0x40) - memcpy(rect->data[1], palette->clut, rect->nb_colors * sizeof(uint32_t)); } return 1; } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
