[PR] avcodec/dvbsub_parser: avoid signed overflow in the capacity check (PR #23897)

PR #23897 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897.patch

Fixes: signed integer overflow
Fixes: out of array access
Fixes: poc.wtv
Fixes: fJeEU9JwKwsR
Found-by: Adrian Junge (vurlo)



>From f7b4c4d68f9d5d7561969f479d41756adc42c3e8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 22 Jul 2026 05:49:11 +0200
Subject: [PATCH] avcodec/dvbsub_parser: avoid signed overflow in the capacity
 check

Fixes: signed integer overflow
Fixes: out of array access
Fixes: poc.wtv
Fixes: fJeEU9JwKwsR
Found-by: Adrian Junge (vurlo)
---
 libavcodec/dvbsub_parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c
index 4527e4dd75..a93f39bfe0 100644
--- a/libavcodec/dvbsub_parser.c
+++ b/libavcodec/dvbsub_parser.c
@@ -104,7 +104,7 @@ static int dvbsub_parse(AVCodecParserContext *s,
         }
     }
 
-    if (buf_size - buf_pos + pc->packet_index > PARSE_BUF_SIZE)
+    if (buf_size - buf_pos > PARSE_BUF_SIZE - pc->packet_index)
         return buf_size;
 
 /* if not currently in a packet, pass data */
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]