PR #24475 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24475 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24475.patch
Fixes: out of array access Fixes: crafted_dvd / gen_dvd.py Fixes: lctl8HITfXru Found-by: zhang xingxing >From 1d66aa66a42f9daa7557dfc92397d1c21008b0c6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 14 Sep 2026 02:00:50 +0200 Subject: [PATCH] avformat/dvdvideodec: stop advancing past the last cell of a menu PGC Fixes: out of array access Fixes: crafted_dvd / gen_dvd.py Fixes: lctl8HITfXru Found-by: zhang xingxing --- libavformat/dvdvideodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 1e397e3bf5..315197ad30 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -416,7 +416,7 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState /* we were at the end of a vobu, so now go to the next one or EOF */ if (!state->vobu_remaining && state->in_pgc) { if (state->vobu_next == SRI_END_OF_CELL) { - if (state->celln == state->celln_end && state->sector_offset > state->sector_end) + if (state->celln >= state->pgc->nr_of_cells) return AVERROR_EOF; state->celln++; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
