Fix OOB read/write in Teletext G0 charset remapping

cfsmp3 · web-flow · commit b5bc0e2616c6 · 2026-01-05T11:28:11.000+01:00
diff --git a/src/lib_ccx/telxcc.c b/src/lib_ccx/telxcc.c
@@ -434,10 +434,21 @@ void remap_g0_charset(uint8_t c)
 {
 	if (c != primary_charset.current)
 	{
+		if (c >= 56)
+		{
+			fprintf(stderr, "- G0 Latin National Subset ID 0x%1x.%1x is out of bounds\n", (c >> 3), (c & 0x7));
+			return;
+		}
 		uint8_t m = G0_LATIN_NATIONAL_SUBSETS_MAP[c];
 		if (m == 0xff)
 		{
 			fprintf(stderr, "- G0 Latin National Subset ID 0x%1x.%1x is not implemented\n", (c >> 3), (c & 0x7));
+			return;
+		}
+		else if (m >= 14)
+		{
+			fprintf(stderr, "- G0 Latin National Subset index %d is out of bounds\n", m);
+			return;
 		}
 		else
 		{

Original file line number	Diff line number	Diff line change
`@@ -434,10 +434,21 @@ void remap_g0_charset(uint8_t c)`
`434`	`434`	`{`
`435`	`435`	`if (c != primary_charset.current)`
`436`	`436`	`{`
	`437`	`+ if (c >= 56)`
	`438`	`+ {`
	`439`	`+ fprintf(stderr, "- G0 Latin National Subset ID 0x%1x.%1x is out of bounds\n", (c >> 3), (c & 0x7));`
	`440`	`+ return;`
	`441`	`+ }`
`437`	`442`	`uint8_t m = G0_LATIN_NATIONAL_SUBSETS_MAP[c];`
`438`	`443`	`if (m == 0xff)`
`439`	`444`	`{`
`440`	`445`	`fprintf(stderr, "- G0 Latin National Subset ID 0x%1x.%1x is not implemented\n", (c >> 3), (c & 0x7));`
	`446`	`+ return;`
	`447`	`+ }`
	`448`	`+ else if (m >= 14)`
	`449`	`+ {`
	`450`	`+ fprintf(stderr, "- G0 Latin National Subset index %d is out of bounds\n", m);`
	`451`	`+ return;`
`441`	`452`	`}`
`442`	`453`	`else`
`443`	`454`	`{`