Skip to content

Framebuffer overflow protection #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Framebuffer overflow protection #124

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
08223f4
refactor: replace 'int' with 'size_t' in buffer
dmitrylyzo Jan 31, 2022
48491ac
refactor: remove recalculation of the buffer size
dmitrylyzo Feb 6, 2022
fecd5e5
Limit frame buffer size to protect it from overflow
dmitrylyzo Jan 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 19 additions & 6 deletions src/SubtitleOctopus.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,18 @@

int log_level = 3;

// maximum frame buffer width (8K resolution)
const size_t FRAMEBUFFER_MAX_WIDTH = 7680;
// maximum frame buffer height (8K resolution)
const size_t FRAMEBUFFER_MAX_HEIGHT = 4320;

typedef struct {
void *buffer;
int size;
int lessen_counter;
size_t size;
size_t lessen_counter;
} buffer_t;

void* buffer_resize(buffer_t *buf, int new_size, int keep_content) {
void* buffer_resize(buffer_t *buf, size_t new_size, int keep_content) {
if (buf->size >= new_size) {
if (buf->size >= 1.3 * new_size) {
// big reduction request
Expand Down Expand Up @@ -56,7 +61,7 @@ void* buffer_resize(buffer_t *buf, int new_size, int keep_content) {

void buffer_init(buffer_t *buf) {
buf->buffer = NULL;
buf->size = -1;
buf->size = 0;
buf->lessen_counter = 0;
}

Expand Down Expand Up @@ -163,6 +168,13 @@ class SubtitleOctopus {

/* CANVAS */
void resizeCanvas(int frame_w, int frame_h) {
if (frame_w > FRAMEBUFFER_MAX_WIDTH || frame_h > FRAMEBUFFER_MAX_HEIGHT) {
Copy link
Contributor Author

@dmitrylyzo dmitrylyzo Feb 8, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, what about <= 0? Exit with some code or set some default values?
Also, portrait orientation 🤔 Lazy option - FRAMEBUFFER_MAX_SIZE = 8192 for both.

fprintf(stderr, "jso: canvas is oversized - %dx%d\n", frame_w, frame_h);
if (frame_w > FRAMEBUFFER_MAX_WIDTH) frame_w = FRAMEBUFFER_MAX_WIDTH;
if (frame_h > FRAMEBUFFER_MAX_HEIGHT) frame_h = FRAMEBUFFER_MAX_HEIGHT;
printf("jso: canvas is trimmed to %dx%d\n", frame_w, frame_h);
}

ass_set_frame_size(ass_renderer, frame_w, frame_h);
canvas_h = frame_h;
canvas_w = frame_w;
Expand Down Expand Up @@ -268,12 +280,13 @@ class SubtitleOctopus {
}

// make float buffer for blending
float* buf = (float*)buffer_resize(&m_blend, sizeof(float) * width * height * 4, 0);
const size_t buffer_size = width * height * 4 * sizeof(float);
float* buf = (float*)buffer_resize(&m_blend, buffer_size, 0);
if (buf == NULL) {
fprintf(stderr, "jso: cannot allocate buffer for blending\n");
return &m_blendResult;
}
memset(buf, 0, sizeof(float) * width * height * 4);
memset(buf, 0, buffer_size);

// blend things in
for (cur = img; cur != NULL; cur = cur->next) {
Expand Down