# HG changeset patch # User reimar # Date 1369483615 0 # Node ID 71360817b772186eabb40be3d8b112bf220f1a7c # Parent 34116de1aa96a9ae038c7e365f723d3b7ebf821f Discard parts that we do not actually care about instead of reading them in. Since more than one character can match, this could read beyond the target variable. Based on patch by wm4 (nfxjfg googlemail.com). diff -r 34116de1aa96 -r 71360817b772 sub/subreader.c --- a/sub/subreader.c Sat May 25 08:42:25 2013 +0000 +++ b/sub/subreader.c Sat May 25 12:06:55 2013 +0000 @@ -378,14 +378,14 @@ int h1, m1, s1, ms1, h2, m2, s2, ms2, j = 0; while (!current->text[0]) { - char line[LINE_LEN + 1], full_line[LINE_LEN + 1], sep; + char line[LINE_LEN + 1], full_line[LINE_LEN + 1]; int i; /* Parse SubRip header */ if (!stream_read_line(st, line, LINE_LEN, utf16)) return NULL; - if (sscanf(line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d", - &h1, &m1, &s1, &sep, &ms1, &h2, &m2, &s2, &sep, &ms2) < 10) + if (sscanf(line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d", + &h1, &m1, &s1, &ms1, &h2, &m2, &s2, &ms2) < 8) continue; current->start = h1 * 360000 + m1 * 6000 + s1 * 100 + ms1 / 10; @@ -442,7 +442,7 @@ #endif while (!current->text[0]) { if (!stream_read_line (st, line, LINE_LEN, utf16)) return NULL; - if ((len=sscanf (line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d",&a1,&a2,&a3,(char *)&i,&a4,&b1,&b2,&b3,(char *)&i,&b4)) < 10) + if ((len=sscanf (line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d",&a1,&a2,&a3,&a4,&b1,&b2,&b3,&b4)) < 8) continue; current->start = a1*360000+a2*6000+a3*100+a4/10; current->end = b1*360000+b2*6000+b3*100+b4/10; @@ -1123,7 +1123,7 @@ {*uses_time=1;return SUB_MPL2;} if (sscanf (line, "%d:%d:%d.%d,%d:%d:%d.%d", &i, &i, &i, &i, &i, &i, &i, &i)==8) {*uses_time=1;return SUB_SUBRIP;} - if (sscanf (line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d", &i, &i, &i, (char *)&i, &i, &i, &i, &i, (char *)&i, &i)==10) + if (sscanf (line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d", &i, &i, &i, &i, &i, &i, &i, &i)==8) {*uses_time=1;return SUB_SUBVIEWER;} if (sscanf (line, "{T %d:%d:%d:%d",&i, &i, &i, &i)==4) {*uses_time=1;return SUB_SUBVIEWER2;}