diff options
| author | Sebastian Dröge <sebastian@centricular.com> | 2023-05-15 11:45:12 +0300 |
|---|---|---|
| committer | GStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2023-06-11 17:18:01 +0000 |
| commit | cd9420bcd6739a926f82c4c656d02b28d1903c40 (patch) | |
| tree | 2b70de519b3952375688a22d14053d660f2c341c | |
| parent | 09cc614bb19e2abe1154601d1ae27186f65098ea (diff) | |
qtmux: Fix extraction of CEA608 data from S334-1A packets
The index is already incremented by 3 every iteration so multiplying it
by 3 additionally on each array access is doing it twice and does not
work.
This caused invalid files to be created if there's more than one CEA608
triplet in a buffer, and out of bounds memory reads.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4832>
| -rw-r--r-- | subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c b/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c index 96d08c00d4..7a70a7af17 100644 --- a/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c +++ b/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c @@ -918,16 +918,16 @@ extract_608_field_from_s334_1a (const guint8 * ccdata, gsize ccdata_size, /* Iterate over the ccdata and put the corresponding tuples for the given field * in the storage */ for (i = 0; i < ccdata_size; i += 3) { - if ((field == 1 && (ccdata[i * 3] & 0x80)) || - (field == 2 && !(ccdata[i * 3] & 0x80))) { + if ((field == 1 && (ccdata[i] & 0x80)) || + (field == 2 && !(ccdata[i] & 0x80))) { GST_DEBUG ("Storing matching cc for field %d : 0x%02x 0x%02x", field, - ccdata[i * 3 + 1], ccdata[i * 3 + 2]); + ccdata[i + 1], ccdata[i + 2]); if (res_size >= storage_size) { storage_size += 128; storage = g_realloc (storage, storage_size); } - storage[res_size] = ccdata[i * 3 + 1]; - storage[res_size + 1] = ccdata[i * 3 + 2]; + storage[res_size] = ccdata[i + 1]; + storage[res_size + 1] = ccdata[i + 2]; res_size += 2; } } |