File CVE-2025-47806.patch of Package gstreamer-plugins-base.39271

From edca7f83d107fb6a55dbd46196fc40b99857a85e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 8 May 2025 12:46:40 +0300
Subject: [PATCH] subparse: Make sure that subrip time string is not too long
 before zero-padding

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4419
Fixes CVE-2025-47806

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9132>
---
diff -urp gst-plugins-base-1.24.0.orig/gst/subparse/gstsubparse.c gst-plugins-base-1.24.0/gst/subparse/gstsubparse.c
--- gst-plugins-base-1.24.0.orig/gst/subparse/gstsubparse.c	2025-06-10 16:05:04.466270285 -0500
+++ gst-plugins-base-1.24.0/gst/subparse/gstsubparse.c	2025-06-10 16:05:10.690313704 -0500
@@ -848,7 +848,7 @@ parse_subrip_time (const gchar * ts_stri
   g_strdelimit (s, " ", '0');
   g_strdelimit (s, ".", ',');
 
-  /* make sure we have exactly three digits after he comma */
+  /* make sure we have exactly three digits after the comma */
   p = strchr (s, ',');
   if (p == NULL) {
     /* If there isn't a ',' the timestamp is broken */
@@ -856,6 +856,15 @@ parse_subrip_time (const gchar * ts_stri
     GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
     return FALSE;
   }
+
+  /* Check if the comma is too far into the string to avoid
+   * stack overflow when zero-padding the sub-second part.
+   *
+   * Allow for 3 digits of hours just in case. */
+  if ((p - s) > sizeof ("hhh:mm:ss,")) {
+    GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
+    return FALSE;
+  }
 
   ++p;
   len = strlen (p);