From da4380c4df0e00f8d0bad569927bfc7ea35ec37d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 8 May 2025 12:46:40 +0300
Subject: [PATCH] subparse: Make sure that subrip time string is not too long
 before zero-padding

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4419
Fixes CVE-2025-47806

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9135>

CVE: CVE-2025-47806
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 gst/subparse/gstsubparse.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/gst/subparse/gstsubparse.c b/gst/subparse/gstsubparse.c
index 4ea4ec6..035068d 100644
--- a/gst/subparse/gstsubparse.c
+++ b/gst/subparse/gstsubparse.c
@@ -850,7 +850,7 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
   g_strdelimit (s, " ", '0');
   g_strdelimit (s, ".", ',');
 
-  /* make sure we have exactly three digits after he comma */
+  /* make sure we have exactly three digits after the comma */
   p = strchr (s, ',');
   if (p == NULL) {
     /* If there isn't a ',' the timestamp is broken */
@@ -859,6 +859,15 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
     return FALSE;
   }
 
+  /* Check if the comma is too far into the string to avoid
+   * stack overflow when zero-padding the sub-second part.
+   *
+   * Allow for 3 digits of hours just in case. */
+  if ((p - s) > sizeof ("hhh:mm:ss,")) {
+    GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
+    return FALSE;
+  }
+
   ++p;
   len = strlen (p);
   if (len > 3) {
-- 
2.50.1

