Author: reimar Date: Sat May 25 14:06:55 2013 New Revision: 36285 Log: Discard parts that we do not actually care about instead of reading them in. Since more than one character can match, this could read beyond the target variable. Based on patch by wm4 (nfxjfg googlemail.com). Modified: trunk/sub/subreader.c Modified: trunk/sub/subreader.c ============================================================================== --- trunk/sub/subreader.c Sat May 25 10:42:25 2013 (r36284) +++ trunk/sub/subreader.c Sat May 25 14:06:55 2013 (r36285) @@ -378,14 +378,14 @@ static subtitle *sub_ass_read_line_subvi int h1, m1, s1, ms1, h2, m2, s2, ms2, j = 0; while (!current->text[0]) { - char line[LINE_LEN + 1], full_line[LINE_LEN + 1], sep; + char line[LINE_LEN + 1], full_line[LINE_LEN + 1]; int i; /* Parse SubRip header */ if (!stream_read_line(st, line, LINE_LEN, utf16)) return NULL; - if (sscanf(line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d", - &h1, &m1, &s1, &sep, &ms1, &h2, &m2, &s2, &sep, &ms2) < 10) + if (sscanf(line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d", + &h1, &m1, &s1, &ms1, &h2, &m2, &s2, &ms2) < 8) continue; current->start = h1 * 360000 + m1 * 6000 + s1 * 100 + ms1 / 10; @@ -442,7 +442,7 @@ static subtitle *sub_read_line_subviewer #endif while (!current->text[0]) { if (!stream_read_line (st, line, LINE_LEN, utf16)) return NULL; - if ((len=sscanf (line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d",&a1,&a2,&a3,(char *)&i,&a4,&b1,&b2,&b3,(char *)&i,&b4)) < 10) + if ((len=sscanf (line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d",&a1,&a2,&a3,&a4,&b1,&b2,&b3,&b4)) < 8) continue; current->start = a1*360000+a2*6000+a3*100+a4/10; current->end = b1*360000+b2*6000+b3*100+b4/10; @@ -1123,7 +1123,7 @@ static int sub_autodetect (stream_t* st, {*uses_time=1;return SUB_MPL2;} if (sscanf (line, "%d:%d:%d.%d,%d:%d:%d.%d", &i, &i, &i, &i, &i, &i, &i, &i)==8) {*uses_time=1;return SUB_SUBRIP;} - if (sscanf (line, "%d:%d:%d%[,.:]%d --> %d:%d:%d%[,.:]%d", &i, &i, &i, (char *)&i, &i, &i, &i, &i, (char *)&i, &i)==10) + if (sscanf (line, "%d:%d:%d%*[,.:]%d --> %d:%d:%d%*[,.:]%d", &i, &i, &i, &i, &i, &i, &i, &i)==8) {*uses_time=1;return SUB_SUBVIEWER;} if (sscanf (line, "{T %d:%d:%d:%d",&i, &i, &i, &i)==4) {*uses_time=1;return SUB_SUBVIEWER2;}