[MPlayer-cvslog] r19618 - trunk/libass/ass.c

[Rich Felker]

On Fri, Sep 01, 2006 at 05:45:45PM +0400, Evgeniy Stepanov wrote:
> On Friday 01 September 2006 17:53, Rich Felker wrote:
> > On Fri, Sep 01, 2006 at 12:45:21AM +0200, eugeni wrote:
> > > Author: eugeni
> > > Date: Fri Sep  1 00:45:20 2006
> > > New Revision: 19618
> > >
> > > Modified:
> > >    trunk/libass/ass.c
> > >
> > > Log:
> > > Bugfix: potential write of unallocated memory.
> > >
> > >
> > > Modified: trunk/libass/ass.c
> > > =========================================================================
> > >===== --- trunk/libass/ass.c	(original)
> > > +++ trunk/libass/ass.c	Fri Sep  1 00:45:20 2006
> > > @@ -282,9 +282,11 @@
> > >  		if (strcasecmp(tname, "Text") == 0) {
> > >  			char* last;
> > >  			event->Text = strdup(p);
> > > -			last = event->Text + strlen(event->Text) - 1;
> > > -			if (*last == '\r')
> > > -				*last = 0;
> > > +			if (*event->Text != 0) {
> > > +				last = event->Text + strlen(event->Text) - 1;
> > > +				if (last >= event->Text && *last == '\r')
> > > +					*last = 0;
> > > +			}
> >
> > huh??
> > strlen(event->Text) will already have crashed if strdup failed.
> 
> It is possible that event->Text has zero length.

what about if ((last = strchr(event->Text, '\r'))) *last = 0;
that's the way i usually do it..
if you're worried about embedded \r not at eol you could add
&&!last[1] to the conditional.

oh well, not terribly important anyway.

rich