On Mon, Dec 20, 2021 at 01:39:47AM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
> > ---
> > libavcodec/ass.c | 33 +++++++++++++++++++++++++++------
> > libavcodec/ass.h | 7 +++++++
> > 2 files changed, 34 insertions(+), 6 deletions(-)
> >
> > diff --git a/libavcodec/ass.c b/libavcodec/ass.c
> > index 725e4d42ba1..06714678722 100644
> > --- a/libavcodec/ass.c
> > +++ b/libavcodec/ass.c
> > @@ -114,17 +114,31 @@ char *ff_ass_get_dialog(int readorder, int layer,
> > const char *style,
> > speaker ? speaker : "", text);
> > }
> >
> > -int ff_ass_add_rect(AVSubtitle *sub, const char *dialog,
> > +int ff_ass_add_rect2(AVSubtitle *sub, const char *dialog,
> > int readorder, int layer, const char *style,
> > - const char *speaker)
> > + const char *speaker, unsigned *nb_rect_allocated)
> > {
> > - AVSubtitleRect **rects, *rect;
> > + AVSubtitleRect **rects = sub->rects, *rect;
> > char *ass_str;
> > + uint64_t new_nb = 0;
> >
> > - rects = av_realloc_array(sub->rects, sub->num_rects+1,
> > sizeof(*sub->rects));
> > - if (!rects)
> > + if (sub->num_rects >= UINT_MAX)
> > return AVERROR(ENOMEM);
> > - sub->rects = rects;
> > +
> > + if (nb_rect_allocated && *nb_rect_allocated <= sub->num_rects) {
> > + new_nb = FFMIN(sub->num_rects + sub->num_rects/16LL + 1, UINT_MAX);
>
> This presumes that unsigned is not 64bits itself; I have no problem with
> this, so LGTM from me. Others may disagree.if unsigned is 64bit how would you exploit this ? for this to overflow you would first need close to 2^64 successfully allocated rectangles. Thats both alot of space and time. I mean if every human on earth had a 32gb stick then all these together in a single computer would not be enough to allow this to succeed and that has to happen before the function is changed to the correct size_t type as my previous patch did. will post a new patch thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB If a bugfix only changes things apparently unrelated to the bug with no further explanation, that is a good sign that the bugfix is wrong.
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
