diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-14 16:18:40 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-14 16:38:33 +0200 |
| commit | dc6f1a8dda00c3bc206486396e4a11941fc1cbe3 (patch) | |
| tree | bdb9805a1665650dec5bcedd49fd0fa941c912cd /libavformat/srtdec.c | |
| parent | 6b13f54262b64036272ddd2b4b1dda191e635913 (diff) | |
| download | ffmpeg-dc6f1a8dda00c3bc206486396e4a11941fc1cbe3.tar.gz | |
avformat/srtdec: Fix pointer corruption
This fixes use of uninitialized memory and possible out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/srtdec.c')
| -rw-r--r-- | libavformat/srtdec.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/srtdec.c b/libavformat/srtdec.c index 76e06e4165..dbf1866202 100644 --- a/libavformat/srtdec.c +++ b/libavformat/srtdec.c @@ -63,10 +63,12 @@ static int64_t get_pts(const char **buf, int *duration, int64_t start = (hh1*3600LL + mm1*60LL + ss1) * 1000LL + ms1; int64_t end = (hh2*3600LL + mm2*60LL + ss2) * 1000LL + ms2; *duration = end - start; - *buf += strcspn(*buf, "\n") + 1; + *buf += strcspn(*buf, "\n"); + *buf += !!**buf; return start; } - *buf += strcspn(*buf, "\n") + 1; + *buf += strcspn(*buf, "\n"); + *buf += !!**buf; } return AV_NOPTS_VALUE; } |