diff options
author | Sebastian Dröge <sebastian@centricular.com> | 2023-05-15 11:45:12 +0300 |
---|---|---|
committer | GStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2023-05-16 11:29:45 +0000 |
commit | 99285bb566896ce80ca6d90f2c5009339c26ddb5 (patch) | |
tree | d0c18b46a62fd3f9e87524282b2d4dd192ac54d3 /subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c | |
parent | 3497bbb8a8bd1ef41b5d08d5be7a4b67eb7c4191 (diff) |
qtmux: Fix extraction of CEA608 data from S334-1A packets
The index is already incremented by 3 every iteration so multiplying it
by 3 additionally on each array access is doing it twice and does not
work.
This caused invalid files to be created if there's more than one CEA608
triplet in a buffer, and out of bounds memory reads.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4634>
Diffstat (limited to 'subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c')
-rw-r--r-- | subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c b/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c index 26a10bf3a1..488d597ee2 100644 --- a/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c +++ b/subprojects/gst-plugins-good/gst/isomp4/gstqtmux.c @@ -926,16 +926,16 @@ extract_608_field_from_s334_1a (const guint8 * ccdata, gsize ccdata_size, /* Iterate over the ccdata and put the corresponding tuples for the given field * in the storage */ for (i = 0; i < ccdata_size; i += 3) { - if ((field == 1 && (ccdata[i * 3] & 0x80)) || - (field == 2 && !(ccdata[i * 3] & 0x80))) { + if ((field == 1 && (ccdata[i] & 0x80)) || + (field == 2 && !(ccdata[i] & 0x80))) { GST_DEBUG ("Storing matching cc for field %d : 0x%02x 0x%02x", field, - ccdata[i * 3 + 1], ccdata[i * 3 + 2]); + ccdata[i + 1], ccdata[i + 2]); if (res_size >= storage_size) { storage_size += 128; storage = g_realloc (storage, storage_size); } - storage[res_size] = ccdata[i * 3 + 1]; - storage[res_size + 1] = ccdata[i * 3 + 2]; + storage[res_size] = ccdata[i + 1]; + storage[res_size + 1] = ccdata[i + 2]; res_size += 2; } } |