[FFmpeg-cvslog] avformat/srtdec: Fix pointer corruption

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue May 14 16:18:40 2013 +0200| [dc6f1a8dda00c3bc206486396e4a11941fc1cbe3] | committer: Michael Niedermayer

avformat/srtdec: Fix pointer corruption

This fixes use of uninitialized memory and possible out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc6f1a8dda00c3bc206486396e4a11941fc1cbe3
---

 libavformat/srtdec.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/srtdec.c b/libavformat/srtdec.c
index 76e06e4..dbf1866 100644
--- a/libavformat/srtdec.c
+++ b/libavformat/srtdec.c
@@ -63,10 +63,12 @@ static int64_t get_pts(const char **buf, int *duration,
             int64_t start = (hh1*3600LL + mm1*60LL + ss1) * 1000LL + ms1;
             int64_t end   = (hh2*3600LL + mm2*60LL + ss2) * 1000LL + ms2;
             *duration = end - start;
-            *buf += strcspn(*buf, "\n") + 1;
+            *buf += strcspn(*buf, "\n");
+            *buf += !!**buf;
             return start;
         }
-        *buf += strcspn(*buf, "\n") + 1;
+        *buf += strcspn(*buf, "\n");
+        *buf += !!**buf;
     }
     return AV_NOPTS_VALUE;
 }