From 351488be47f1764f347a3db4eb5a31e08dad29b7 Mon Sep 17 00:00:00 2001
From: Oneric <oneric@oneric.stub>
Date: Tue, 12 Apr 2022 19:56:25 +0200
Subject: ass: fix NULL usage in embedded font parsing

If fontdata hasn't been allocated yet and an empty line occured
NULL was passed to memcpy which is always undefined behaviour
(and there was pointer arithmetic on NULL which is also UB).

Found by AFL++ and UBSAN.
---
 libass/ass.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libass/ass.c b/libass/ass.c
index b9eac1b..991d31b 100644
--- a/libass/ass.c
+++ b/libass/ass.c
@@ -932,6 +932,8 @@ static int process_fonts_line(ASS_Track *track, char *str)
             goto mem_fail;
         track->parser_priv->fontdata_size = new_size;
     }
+    if (!track->parser_priv->fontdata)
+        return 0;
     memcpy(track->parser_priv->fontdata + track->parser_priv->fontdata_used,
            str, len);
     track->parser_priv->fontdata_used += len;
-- 
cgit v1.2.3