If allocating fonts fails when reading the header, all fonts are freed,
yet the counter of fonts is not reset and no error is returned; when
subtitles are decoded lateron, the inexistent list of fonts is searched
for the matching font for this particular entry which of course leads to
a segfault.
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
}
}
av_freep(&m->ftab);
+ m->ftab_entries = 0;
}
static int mov_text_tx3g(AVCodecContext *avctx, MovTextContext *m)
box_size += 3;
if (avctx->extradata_size < box_size) {
mov_text_cleanup_ftab(m);
- m->ftab_entries = 0;
return -1;
}
m->ftab_temp = av_mallocz(sizeof(*m->ftab_temp));
box_size = box_size + font_length;
if (avctx->extradata_size < box_size) {
mov_text_cleanup_ftab(m);
- m->ftab_entries = 0;
return -1;
}
m->ftab_temp->font = av_malloc(font_length + 1);