Fix title N variable formatting

Do not assume the title number is small; allocate large enough buffer.

lib/media_player.c

@@ -1266,19 +1266,15 @@ int libvlc_media_player_get_chapter_count_for_title(
                                  libvlc_media_player_t *p_mi,
                                  int i_title )
 {
-    input_thread_t *p_input_thread;
     vlc_value_t val;
 
-    p_input_thread = libvlc_get_input_thread ( p_mi );
+    input_thread_t *p_input_thread = libvlc_get_input_thread ( p_mi );
     if( !p_input_thread )
         return -1;
 
-    char *psz_name;
-    if( asprintf( &psz_name,  "title %2i", i_title ) == -1 )
-    {
-        vlc_object_release( p_input_thread );
-        return -1;
-    }
+    char psz_name[sizeof ("title ") + 3 * sizeof (int)];
+    sprintf( psz_name, "title %2u", i_title );
+
     int i_ret = var_Change( p_input_thread, psz_name, VLC_VAR_CHOICESCOUNT, &val, NULL );
     vlc_object_release( p_input_thread );
     free( psz_name );

lib/video.c

@@ -405,8 +405,8 @@ libvlc_track_description_t *
         libvlc_video_get_chapter_description( libvlc_media_player_t *p_mi,
                                               int i_title )
 {
-    char psz_title[12];
-    sprintf( psz_title,  "title %2i", i_title );
+    char psz_title[sizeof ("title ") + 3 * sizeof (int)];
+    sprintf( psz_title,  "title %2u", i_title );
     return libvlc_get_track_description( p_mi, psz_title );
 }
 

modules/gui/qt4/menus.cpp

@@ -1354,15 +1354,15 @@ void VLCMenuBar::UpdateItem( intf_thread_t *p_intf, QMenu *menu,
 #undef TEXT_OR_VAR
 
 /** HACK for the navigation submenu:
- * "title %2i" variables take the value 0 if not set
+ * "title %2u" variables take the value 0 if not set
  */
 static bool CheckTitle( vlc_object_t *p_object, const char *psz_var )
 {
-    int i_title = 0;
-    if( sscanf( psz_var, "title %2i", &i_title ) <= 0 )
+    unsigned i_title = 0;
+    if( sscanf( psz_var, "title %2u", &i_title ) <= 0 )
         return true;
 
-    int i_current_title = var_GetInteger( p_object, "title" );
+    unsigned i_current_title = var_GetInteger( p_object, "title" );
     return ( i_title == i_current_title );
 }
 

src/input/event.c

@@ -149,9 +149,9 @@ void input_SendEventSeekpoint( input_thread_t *p_input, int i_title, int i_seekp
     val.i_int = i_seekpoint;
     var_Change( p_input, "chapter", VLC_VAR_SETVALUE, &val, NULL );
 
-    /* "title %2i" */
-    char psz_title[10];
-    snprintf( psz_title, sizeof(psz_title), "title %2i", i_title );
+    /* "title %2u" */
+    char psz_title[sizeof ("title ") + 3 * sizeof (int)];
+    sprintf( psz_title, "title %2u", i_title );
     var_Change( p_input, psz_title, VLC_VAR_SETVALUE, &val, NULL );
 
     /* */

src/input/var.c

@@ -235,15 +235,14 @@ void input_ControlVarStop( input_thread_t *p_input )
 
     if( p_input->p->i_title > 0 )
     {
-        char name[sizeof("title ") + 5 ];
-        int i;
-
         InputDelCallbacks( p_input, p_input_navigation_callbacks );
         InputDelCallbacks( p_input, p_input_title_callbacks );
 
-        for( i = 0; i < p_input->p->i_title; i++ )
+        for( int i = 0; i < p_input->p->i_title; i++ )
         {
-            snprintf( name, sizeof(name), "title %2i", i );
+            char name[sizeof("title ") + 3 * sizeof (int)];
+
+            sprintf( name, "title %2u", i );
             var_DelCallback( p_input, name, NavigationCallback, (void *)(intptr_t)i );
         }
     }