Skip to content

[video_player_avplay] Fix picture subtitle display issue #964

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xiaowei-guan merged 2 commits into from
Mar 3, 2026
Merged

[video_player_avplay] Fix picture subtitle display issue #964

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
70692f0
fix picture subtitle display issue
gin7773 Mar 2, 2026
26984e8
update version
gin7773 Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/video_player_avplay/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
## 0.8.3

* Update plusplayer
1. [DASH] Fix picture subtitle display issue.

## 0.8.2

* Adds compatibility with `http` 1.0 in example.
Expand Down
2 changes: 1 addition & 1 deletion packages/video_player_avplay/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ To use this package, add `video_player_avplay` as a dependency in your `pubspec.

```yaml
dependencies:
video_player_avplay: ^0.8.2
video_player_avplay: ^0.8.3
```

Then you can import `video_player_avplay` in your Dart code:
Expand Down
2 changes: 1 addition & 1 deletion packages/video_player_avplay/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: video_player_avplay
description: Flutter plugin for displaying inline video on Tizen TV devices.
homepage: https://github.com/flutter-tizen/plugins
repository: https://github.com/flutter-tizen/plugins/tree/master/packages/video_player_avplay
version: 0.8.2
version: 0.8.3

environment:
sdk: ">=3.1.0 <4.0.0"
Expand Down
Binary file modified packages/video_player_avplay/tizen/lib/armel/10.0/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
Binary file modified packages/video_player_avplay/tizen/lib/armel/6.0/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
Binary file modified packages/video_player_avplay/tizen/lib/armel/6.5/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
Binary file modified packages/video_player_avplay/tizen/lib/armel/7.0/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
Binary file modified packages/video_player_avplay/tizen/lib/armel/8.0/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
Binary file modified packages/video_player_avplay/tizen/lib/armel/9.0/libavcodec_common.so
View file
Open in desktop
Binary file not shown.
2 changes: 0 additions & 2 deletions packages/video_player_avplay/tizen/src/plus_player.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1307,7 +1307,6 @@ void PlusPlayer::OnSubtitleData(char *data, const int size,
}

if (type == plusplayer::SubtitleType::kPicture) {
#ifdef PICTURE_SUBTITLE_SUPPORT
Copy link

@gemini-code-assist gemini-code-assist bot Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The removal of #ifdef PICTURE_SUBTITLE_SUPPORT enables code that processes picture subtitles. This code contains several unsafe numeric operations on untrusted input (picture_width and picture_height from the player).

  1. Undefined Behavior (UB) in channels calculation (line 1330): int channels = size / area;. If area is very small (e.g., due to underflow of picture_width * picture_height), size / area can result in Inf. Casting Inf to int is undefined behavior.
  2. Integer Overflow in stride_in_bytes (line 1335): int stride_in_bytes = static_cast<int>(picture_width) * channels;. If picture_width is large (e.g., 2e9) and channels is 2, the product overflows int.
  3. Undefined Behavior in static_cast<int>(picture_width) (line 1335, 1339): If picture_width exceeds INT_MAX, the cast is undefined behavior.

These issues can lead to an incorrect stride_in_bytes or dimensions being passed to stbi_write_png_to_mem (line 1337), which can cause an out-of-bounds read from the data buffer, potentially leading to a crash (DoS) or memory corruption.

if (picture_width <= 0 || picture_height <= 0 || size <= 0) {
LOG_ERROR(
"[PlusPlayer] Invalid picture dimensions or size: size: %d, width: "
Expand Down Expand Up @@ -1357,7 +1356,6 @@ void PlusPlayer::OnSubtitleData(char *data, const int size,
} else {
LOG_ERROR("[PlusPlayer] Picture subtitle data is null or size is 0.");
}
#endif
} else {
LOG_INFO(
"[PlusPlayer] Subtitle is text: duration: %llu, text: %s, type: %d",
Expand Down