Commit e3cef651 authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont

Fix sscanf overflow

Pointed-out-by: default avatarTobias Klein <tk@trapkit.de>
parent 5f63f156
......@@ -1842,7 +1842,6 @@ static int ParseRealText( demux_t *p_demux, subtitle_t *p_subtitle, int i_idx )
demux_sys_t *p_sys = p_demux->p_sys;
text_t *txt = &p_sys->txt;
char *psz_text = NULL;
char psz_end[12]= "", psz_begin[12] = "";
for( ;; )
{
......@@ -1863,13 +1862,14 @@ static int ParseRealText( demux_t *p_demux, subtitle_t *p_subtitle, int i_idx )
char *psz_temp = strcasestr( s, "<time");
if( psz_temp != NULL )
{
char psz_end[12], psz_begin[12];
/* Line has begin and end */
if( ( sscanf( psz_temp,
"<%*[t|T]ime %*[b|B]egin=\"%[^\"]\" %*[e|E]nd=\"%[^\"]%*[^>]%[^\n\r]",
"<%*[t|T]ime %*[b|B]egin=\"%11[^\"]\" %*[e|E]nd=\"%11[^\"]%*[^>]%[^\n\r]",
psz_begin, psz_end, psz_text) != 3 ) &&
/* Line has begin and no end */
( sscanf( psz_temp,
"<%*[t|T]ime %*[b|B]egin=\"%[^\"]\"%*[^>]%[^\n\r]",
"<%*[t|T]ime %*[b|B]egin=\"%11[^\"]\"%*[^>]%[^\n\r]",
psz_begin, psz_text ) != 2) )
/* Line is not recognized */
{
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment