From 0f8c560f7f98ddbae526fd921a54ab5d95bc5dab Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:58 -0500 Subject: [PATCH] avformat/dvdvideodec: check the length of a NAV packet when reading titles Some discs present titles with bogus NAV packets. We apply this check for menus and for title MPEG blocks, but we should also apply it for NAV packets during title demuxing. Signed-off-by: Marth64 --- libavformat/dvdvideodec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 726c45601f..f7c7ba5a3b 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -740,6 +740,13 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState return AVERROR_EOF; } + if (nav_len != DVDVIDEO_BLOCK_SIZE) { + av_log(s, AV_LOG_ERROR, "Invalid NAV packet size (expected=%d actual=%d)\n", + DVDVIDEO_BLOCK_SIZE, nav_len); + + return AVERROR_INVALIDDATA; + } + e_pci = dvdnav_get_current_nav_pci(state->dvdnav); e_dsi = dvdnav_get_current_nav_dsi(state->dvdnav);