Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix teletext memory overflow #17921

Closed
wants to merge 1 commit into from
Closed

Fix teletext memory overflow #17921

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
25 changes: 19 additions & 6 deletions xbmc/video/Teletext.cpp
View file
Open in desktop
Expand Up @@ -1229,8 +1229,9 @@ void CTeletextDecoder::RenderPage()
m_RenderInfo.PageAtrb[32].fg = TXT_ColorYellow;
m_RenderInfo.PageAtrb[32].bg = TXT_ColorMenu1;
int showpage = m_txtCache->PageReceiving;
int showsubpage = m_txtCache->SubPageTable[showpage];
if (showsubpage!=0xff)
int showsubpage;

if (showpage >= 0 && (showsubpage = m_txtCache->SubPageTable[showpage]) != 0xff)
{
TextCachedPage_t *pCachedPage;
pCachedPage = m_txtCache->astCachetable[showpage][showsubpage];
Expand Down Expand Up @@ -1303,6 +1304,12 @@ void CTeletextDecoder::RenderPage()

void CTeletextDecoder::DoFlashing(int startrow)
{
TextCachedPage_t* textcachepage =
m_txtCache->astCachetable[m_txtCache->Page][m_txtCache->SubPage];

if (!textcachepage || m_RenderInfo.PageInfo != &textcachepage->pageinfo)
m_RenderInfo.PageInfo = nullptr;

/* get national subset */
if (m_txtCache->NationalSubset <= NAT_MAX_FROM_HEADER && /* not for GR/RU as long as line28 is not evaluated */
m_RenderInfo.PageInfo && m_RenderInfo.PageInfo->nationalvalid) /* individual subset according to page header */
Expand Down Expand Up @@ -2255,7 +2262,11 @@ void CTeletextDecoder::RenderCharIntern(TextRenderInfo_t* RenderInfo, int Char,

/* render char */
sbitbuffer = m_sBit->buffer;
unsigned char localbuffer[1000]; // should be enough to store one character-bitmap...

std::vector<unsigned char> localbuffer;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know how this part works (teletext) but I think it's very inefficient to create/destroy a vector to render just one character. I suspect that this method will be called multiple times in a row.

It's much better to just increase the buffer size to 2000, 3000, 5000, 10000 or whatever is needed and keep it on the stack. How many pixels does a teletext character have?

The rest of the changes looks fine.


localbuffer.resize((m_sBit->pitch + 1) * m_sBit->height);

// add diacritical marks
if (Attribute->diacrit)
{
Expand All @@ -2275,15 +2286,17 @@ void CTeletextDecoder::RenderCharIntern(TextRenderInfo_t* RenderInfo, int Char,
{
if (FTC_SBitCache_Lookup(m_Cache, &m_TypeTTF, glyph, &sbit_diacrit, NULL) == 0)
{
sbitbuffer = localbuffer;
const int sbitLen = sbit_diacrit->height * sbit_diacrit->pitch;
sbitbuffer = localbuffer.data();
memcpy(sbitbuffer,m_sBit->buffer,m_sBit->pitch*m_sBit->height);

for (Row = 0; Row < m_sBit->height; Row++)
{
for (Pitch = 0; Pitch < m_sBit->pitch; Pitch++)
{
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row)
sbitbuffer[Row*m_sBit->pitch+Pitch] |= sbit_diacrit->buffer[Row*m_sBit->pitch+Pitch];
const int offset = Row * m_sBit->pitch + Pitch;
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row && offset < sbitLen)
sbitbuffer[offset] |= sbit_diacrit->buffer[offset];
}
}
}
Expand Down