CVE-2016-7969

What it actually does

The wrap_lines_smart function in ass_render.c performs an out-of-bounds read during line-wrapping equalization when processing specially crafted ASS subtitle data, resulting in a denial-of-service crash.

Why it matters to the business

Applications that render user-supplied or untrusted subtitle files can be forced offline or crash repeatedly, disrupting media playback, streaming, or content-processing workflows until the vulnerable library is updated.

How an attack unfolds

An attacker crafts an ASS subtitle file that triggers the vulnerable wrap_lines_smart path with specific line counts and wrapping parameters; when the target application parses and renders the file, the out-of-bounds read occurs and terminates the process.

How to fix it

Upgrade libass to version 0.13.4 or later (commit 8551555c86f50f978f9ddd55a8d20bceb80d92fc); consumers of the task package should update to 3.35.1-r1 or newer. Rebuild and redeploy any statically linked applications after the library update.

How to confirm the fix worked

Verify installed libass version is 0.13.4 or newer; run regression tests with known triggering subtitle samples; monitor application logs for absence of crashes on previously crashing inputs.

Typical attack path

1. Attacker supplies a malicious ASS subtitle file to the target application
2. Application invokes libass to parse and render the subtitles
3. wrap_lines_smart processes the crafted line-wrapping data
4. Out-of-bounds read triggers a crash or denial of service

How to detect it

Search process crash logs and core dumps for references to ass_render.c or wrap_lines_smart; correlate application restarts with receipt of external subtitle files; review any available libass debug output for abnormal line-wrapping behavior.

What your security team should do

• Immediately inventory all systems using libass < 0.13.4 and schedule upgrades
• Block untrusted subtitle files from being processed until patched
• Add version checks for libass to software bill-of-materials and CI pipelines