Do not try to access beyound the end of the buffer.

This commit is contained in:
Moritz Bunkus 2009-07-16 21:05:24 +02:00
parent b98128234d
commit c8d18c6674
2 changed files with 5 additions and 2 deletions

View File

@ -1,5 +1,8 @@
2009-07-16 Moritz Bunkus <moritz@bunkus.org>
* mkvmerge: bug fix: Fixed an invalid memory access in the VobSub
reader module.
* mmg: bug fix: Tracks added from Matroska files did not get their
'default track' drop down box set correctly if the flag was 'off'
in the source file and no other track of its kind hat its 'default

View File

@ -332,8 +332,8 @@ vobsub_reader_c::deliver_packet(unsigned char *buf,
duration = default_duration;
mxverb(2, boost::format("vobsub_reader: Could not extract the duration for a SPU packet (timecode: %1%).") % format_timecode(timecode, 3));
uint32_t dcsq = buf[2] << 8 | buf[3];
uint32_t dcsq2 = buf[dcsq + 2] << 8 | buf[dcsq + 3];
int dcsq = get_uint16_be(&buf[2]);
int dcsq2 = dcsq + 3 < size ? get_uint16_be(&buf[dcsq + 2]) : -1;
// Some players ignore sub-pictures if there is no stop display command.
// Add a stop display command only if 1 command chain exists and the hack is enabled.