From c9b0001c1c35b2d1a9a421a2bb560f2bb388c8e3 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sat, 18 Jul 2026 13:48:12 -0700 Subject: [PATCH] subs: error on truncated codec parameters --- src/moov/trak/mdia/minf/stbl/subs.rs | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/src/moov/trak/mdia/minf/stbl/subs.rs b/src/moov/trak/mdia/minf/stbl/subs.rs index ab1e1c50..b1f0516d 100644 --- a/src/moov/trak/mdia/minf/stbl/subs.rs +++ b/src/moov/trak/mdia/minf/stbl/subs.rs @@ -116,8 +116,7 @@ impl AtomExt for Subs { }; let priority = u8::decode(buf)?; let discardable = u8::decode(buf)? == 1; - let codec_specific_parameters = buf.slice(4).to_vec(); - buf.advance(4); + let codec_specific_parameters = <[u8; 4]>::decode(buf)?.to_vec(); subsamples.push(SubsSubsample { size, priority, @@ -207,6 +206,30 @@ mod tests { ) } + #[test] + fn subs_truncated_codec_parameters_return_error() { + let body: &[u8] = &[ + 0x00, 0x00, 0x00, 0x01, // entry_count + 0x00, 0x00, 0x00, 0x01, // sample_delta + 0x00, 0x01, // subsample_count + 0x00, 0x01, // subsample_size + 0x00, // priority + 0x00, // discardable + 0x00, 0x00, 0x00, // truncated codec_specific_parameters + ]; + + assert!(matches!( + Subs::decode_body_ext( + &mut Cursor::new(body), + SubsExt { + version: SubsVersion::V0, + flags: [0; 3], + }, + ), + Err(Error::OutOfBounds) + )); + } + // This example was taken from: // https://mpeggroup.github.io/FileFormatConformance/files/published/nalu/hevc/subs_tile_hvc1.mp4 //