Arnavion / libjass

Renders ASS subs in the browser.
Apache License 2.0
174 stars 29 forks source link

When PlayResX or PlayResY are defined as zero, tab crashes. #101

Open joshuabrown-ellation opened 7 years ago

joshuabrown-ellation commented 7 years ago

To reproduce:

Identification of problem: Libjass uses property PlayResX and PlayResY for scaling of the rendering of effects in CSS, for example _textShadow. The way they are defined is by element width / PlayResX and element height / PlayResY, creating the possibility of a divide by zero condition. Since Javascript defines n / 0 as Infinity, and Libjass tries to setup a for() loop with that number as the break condition, we will run out of memory abruptly.

Proposed solution: Line 346 of renderer.ts: if (this.ass.properties.resolutionX === 0 || this.ass.properties.resolutionY === 0) { this._scaleX = 0; this._scaleY = 0; } else { this._scaleX = width / this.ass.properties.resolutionX; this._scaleY = height / this.ass.properties.resolutionY; }

Arnavion commented 7 years ago

Relevant PlayRes* fixups in libass are at https://github.com/libass/libass/blob/6092e276de387133de4dfb17843a5d8d0b8de3f0/libass/ass.c#L1333

Pseudocode:

switch (x, y) {
    (> 0, > 0) => (x, y),
    (<= 0, <= 0) => (384, 288),
    (1280, <= 0) => (1280, 1024),
    (<= 0, 1024) => (1280, 1024),
    (*, <= 0) => (x, x * 3 / 4),
    (<= 0, *) => (y * 4 / 3, y),
}

libjass should do the same.