File CVE-2025-47806.patch of Package gstreamer-plugins-base.39270

From edca7f83d107fb6a55dbd46196fc40b99857a85e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 8 May 2025 12:46:40 +0300
Subject: [PATCH] subparse: Make sure that subrip time string is not too long
 before zero-padding

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4419
Fixes CVE-2025-47806

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9132>
---
diff -urp gst-plugins-base-1.8.3.orig/gst/subparse/gstsubparse.c gst-plugins-base-1.8.3/gst/subparse/gstsubparse.c
--- gst-plugins-base-1.8.3.orig/gst/subparse/gstsubparse.c	2025-06-11 16:11:25.972729974 -0500
+++ gst-plugins-base-1.8.3/gst/subparse/gstsubparse.c	2025-06-11 16:23:07.368145989 -0500
@@ -836,9 +836,24 @@ parse_subrip_time (const gchar * ts_stri
   g_strdelimit (s, " ", '0');
   g_strdelimit (s, ".", ',');
 
-  /* make sure we have exactly three digits after he comma */
+  /* make sure we have exactly three digits after the comma */
   p = strchr (s, ',');
-  g_assert (p != NULL);
+  if (p == NULL) {
+    /* If there isn't a ',' the timestamp is broken */
+    /* https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/issues/532#note_100179 */
+    GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
+    return FALSE;
+  }
+
+  /* Check if the comma is too far into the string to avoid
+   * stack overflow when zero-padding the sub-second part.
+   *
+   * Allow for 3 digits of hours just in case. */
+  if ((p - s) > sizeof ("hhh:mm:ss,")) {
+    GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
+    return FALSE;
+  }
+
   ++p;
   len = strlen (p);
   if (len > 3) {