X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fpgssubdec.c;h=9c59a2297f17f7daceccb6351d1f0fecd9a2dfde;hb=fb0ae037d024e96093ccbf8cb366dd1fbbdf9644;hp=b897d72aab351c9002f3642f0e4927671493d984;hpb=73d193d1d0ff62a029a905d1404c0fd357f4c880;p=ffmpeg

diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c
index b897d72aab3..9c59a2297f1 100644
--- a/libavcodec/pgssubdec.c
+++ b/libavcodec/pgssubdec.c
@@ -614,7 +614,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
     return 1;
 }
 
-static int decode(AVCodecContext *avctx, void *data, int *data_size,
+static int decode(AVCodecContext *avctx, void *data, int *got_sub_ptr,
                   AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
@@ -636,7 +636,7 @@ static int decode(AVCodecContext *avctx, void *data, int *data_size,
     if (i & 15)
         ff_dlog(avctx, "\n");
 
-    *data_size = 0;
+    *got_sub_ptr = 0;
 
     /* Ensure that we have received at a least a segment code and segment length */
     if (buf_size < 3)
@@ -676,9 +676,14 @@ static int decode(AVCodecContext *avctx, void *data, int *data_size,
              */
             break;
         case DISPLAY_SEGMENT:
+            if (*got_sub_ptr) {
+                av_log(avctx, AV_LOG_ERROR, "Duplicate display segment\n");
+                ret = AVERROR_INVALIDDATA;
+                break;
+            }
             ret = display_end_segment(avctx, data, buf, segment_length);
             if (ret >= 0)
-                *data_size = ret;
+                *got_sub_ptr = ret;
             break;
         default:
             av_log(avctx, AV_LOG_ERROR, "Unknown subtitle segment type 0x%x, length %d\n",
@@ -686,8 +691,11 @@ static int decode(AVCodecContext *avctx, void *data, int *data_size,
             ret = AVERROR_INVALIDDATA;
             break;
         }
-        if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
+        if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) {
+            avsubtitle_free(data);
+            *got_sub_ptr = 0;
             return ret;
+        }
 
         buf += segment_length;
     }