PR #25130 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25130 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25130.patch
>From c4451c00d085bcc792313b995c30381b70ca1bb7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 16 Oct 2026 22:21:59 +0200 Subject: [PATCH 1/2] avcodec/xsubenc: reject subtitles without rectangles Fixes: null pointer dereference Fixes: L22GwbO9rtWF Fixes: AISLE-2026-0150-00413 Null pointer dereference Replicated through API with ASAN Found-by: Joshua Rogers <[email protected]> Rejecting the subtitle with AVERROR(EINVAL) was suggested in the report. --- libavcodec/xsubenc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavcodec/xsubenc.c b/libavcodec/xsubenc.c index 6f417c5958..9e43213ac2 100644 --- a/libavcodec/xsubenc.c +++ b/libavcodec/xsubenc.c @@ -128,8 +128,13 @@ static int xsub_encode(AVCodecContext *avctx, unsigned char *buf, return AVERROR_BUFFER_TOO_SMALL; } + if (!h->num_rects) { + av_log(avctx, AV_LOG_ERROR, "No subtitle rectangle to encode.\n"); + return AVERROR(EINVAL); + } + // TODO: support multiple rects - if (h->num_rects != 1) + if (h->num_rects > 1) av_log(avctx, AV_LOG_WARNING, "Only single rects supported (%d in subtitle.)\n", h->num_rects); // TODO: render text-based subtitles into bitmaps -- 2.54.0 >From ad7e02466bbf1e167d4fd4f06539cbfd2dc4312f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 16 Oct 2026 22:21:59 +0200 Subject: [PATCH 2/2] avcodec/libaribcaption: make the default alpha values unsigned ARIBCC_MAKE_RGBA() shifts the alpha value left by 24 bits, which does not fit in an int for the defaults 0xFF and 0x80. Fixes: libavcodec/libaribcaption.c:650:37: runtime error: left shift of 255 by 24 places cannot be represented in type 'int' Fixes: undefined shift Undefined shift Replicated through UnModified FFmpeg with UBSAN Found during triage/review of the security report AISLE-2026-R0043 (AISLE-2026-0150-00333, 6vQDuOhjPDP6) --- libavcodec/libaribcaption.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/libaribcaption.c b/libavcodec/libaribcaption.c index e8f7cada73..340e8866f8 100644 --- a/libavcodec/libaribcaption.c +++ b/libavcodec/libaribcaption.c @@ -39,8 +39,8 @@ #define ARIBC_BPRINT_SIZE_INIT 64 #define ARIBC_BPRINT_SIZE_MAX (8 * 1024) #define ARIBC_ALPHA_MAX_NUM 4 -#define ARIBC_ALPHA_DEFAULT_FRONT 0xFF -#define ARIBC_ALPHA_DEFAULT_BACK 0x80 +#define ARIBC_ALPHA_DEFAULT_FRONT 0xFFu +#define ARIBC_ALPHA_DEFAULT_BACK 0x80u #define ARIBCC_COLOR_RGB(c) ((c) & 0xFFFFFF) #define ARIBCC_COLOR_DIFF_RGB(c1,c2) (((c1) ^ (c2)) & 0x00FFFFFF) -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
