diff options
author | Uoti Urpala <uau@mplayer2.org> | 2013-04-20 23:44:45 +0300 |
---|---|---|
committer | wm4 <wm4@nowhere> | 2013-05-06 23:11:08 +0200 |
commit | 2cd1a8286b55e183e5cf64c328c3ce8d9a6226fa (patch) | |
tree | d1493b8879c21c1d11822effedb511e27f89f83f | |
parent | 5e727c314e98aa77c255734f4aab5b0d1ad0fd3e (diff) |
subreader: fix one more unsafe sscanf call with "%["
"%[,.:]" conversion was used with a buffer that could be shorter than
the matched string. Suppress assignment of the conversion since the
value wasn't used anyway, and also limit match length to 1 as it
doesn't look like the intent was to match longer runs of the
characters.
Merged from mplayer2 commit 5cb9aac. Note that the other half of the
mplayer2 commit is already part of the mpv commit d98e61e. (I'm not
sure why. The mplayer2 commit date precedes mpv's, but was pushed long
after the mpv change was pushed; either one of the dates is wrong, or
we did the same work twice - in that case, thanks a lot...)
-rw-r--r-- | sub/subreader.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sub/subreader.c b/sub/subreader.c index 0f1b6c9bbd..a109d0c362 100644 --- a/sub/subreader.c +++ b/sub/subreader.c @@ -1074,7 +1074,7 @@ static int sub_autodetect (stream_t* st, int *uses_time, int utf16) { {*uses_time=1;return SUB_MPL2;} if (sscanf (line, "%d:%d:%d.%d,%d:%d:%d.%d", &i, &i, &i, &i, &i, &i, &i, &i)==8) {*uses_time=1;return SUB_SUBRIP;} - if (sscanf (line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d", &i, &i, &i, (char *)&i, &i, &i, &i, &i, (char *)&i, &i)==10) + if (sscanf (line, "%d:%d:%d%*1[,.:]%d --> %d:%d:%d%*1[,.:]%d", &i, &i, &i, &i, &i, &i, &i, &i) == 8) {*uses_time=1;return SUB_SUBVIEWER;} if (sscanf (line, "{T %d:%d:%d:%d",&i, &i, &i, &i)==4) {*uses_time=1;return SUB_SUBVIEWER2;} |