[FFmpeg-devel] [PATCH v2 1/2] avcodec/mpeg12dec: parse A53 caption data embedded in SCTE-20 user data

[Michael Niedermayer]

On Wed, Mar 15, 2017 at 03:32:22PM -0700, Aman Gupta wrote:
> On Wed, Mar 15, 2017 at 2:06 PM, Michael Niedermayer <michael at niedermayer.cc
> > wrote:
> 
> > On Wed, Mar 15, 2017 at 12:53:03PM -0700, Aman Gupta wrote:
> > > From: Aman Gupta <aman at tmm1.net>
> > >
> > > includes a fate test, which requires
> > > https://s3.amazonaws.com/tmm1/ccaptions/scte20.ts
> > > to be uploaded as sub/scte20.ts
> >
> > uploaded
> >
> >
> >
> > > ---
> > >  libavcodec/mpeg12dec.c       | 39 ++++++++++++++++++++++++++++++
> > +++++++++
> > >  tests/fate/subtitles.mak     |  3 +++
> > >  tests/ref/fate/sub-cc-scte20 | 15 +++++++++++++++
> > >  3 files changed, 57 insertions(+)
> > >  create mode 100644 tests/ref/fate/sub-cc-scte20
> > >
> > > diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
> > > index e49167f..cea8963 100644
> > > --- a/libavcodec/mpeg12dec.c
> > > +++ b/libavcodec/mpeg12dec.c
> > > @@ -2260,6 +2260,45 @@ static int mpeg_decode_a53_cc(AVCodecContext
> > *avctx,
> > >              avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
> > >          }
> > >          return 1;
> > > +    } else if (buf_size >= 2 &&
> > > +               p[0] == 0x03 && (p[1]&0x7f) == 0x01) {
> > > +        /* extract SCTE-20 CC data */
> > > +        GetBitContext gb;
> > > +        int cc_count = 0;
> > > +        int i;
> > > +
> > > +        init_get_bits(&gb, p + 2, buf_size - 2);
> > > +        cc_count = get_bits(&gb, 5);
> > > +        if (cc_count > 0) {
> >
> > remainig bits or buf_size should be checked to be large enough for
> > cc_count
> >
> 
> Good catch. Changing to buf_size>=3 in the outer conditional should be
> sufficient, right?

i think its not
the bitstream is initialized with buf_size - 2 so a buf_size  of 3
doesnt seem enough for al that can be read
also see get_bits_left()

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

In a rich man's house there is no place to spit but his face.
-- Diogenes of Sinope
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170316/d534672c/attachment.sig>