Skip to content

Commit

Permalink
SF #11 Caption is not checking for bounds of class and c2 correctly
Browse files Browse the repository at this point in the history
This fixes some array bounds checks that were off by one in the
xds_separator function in caption.c. If class == 4 or c2 == 24 then the
xds_sub_packet "sp" would be set from memory outside the cc->sub_packet
array.

Closes Github issue #16
  • Loading branch information
Gustavo Pichorim Boiko authored and ileanadumitrescu95 committed Sep 27, 2022
1 parent e122d66 commit 8c3a061
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/caption.c
Original file line number Diff line number Diff line change
Expand Up @@ -610,8 +610,8 @@ xds_separator(vbi_decoder *vbi, uint8_t *buf)
case 1 ... 14:
class = (c1 - 1) >> 1;

if (class > elements(cc->sub_packet)
|| c2 > (int) elements(cc->sub_packet[0])) {
if (class >= elements(cc->sub_packet)
|| c2 >= (int) elements(cc->sub_packet[0])) {
XDS_SEP_DEBUG(printf("XDS ignore packet %d/0x%02x\n", class, c2));
cc->curr_sp = NULL;
return;
Expand Down

0 comments on commit 8c3a061

Please sign in to comment.