From dc6f1a8dda00c3bc206486396e4a11941fc1cbe3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 14 May 2013 16:18:40 +0200 Subject: [PATCH] avformat/srtdec: Fix pointer corruption This fixes use of uninitialized memory and possible out of array access Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/srtdec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/srtdec.c b/libavformat/srtdec.c index 76e06e4165..dbf1866202 100644 --- a/libavformat/srtdec.c +++ b/libavformat/srtdec.c @@ -63,10 +63,12 @@ static int64_t get_pts(const char **buf, int *duration, int64_t start = (hh1*3600LL + mm1*60LL + ss1) * 1000LL + ms1; int64_t end = (hh2*3600LL + mm2*60LL + ss2) * 1000LL + ms2; *duration = end - start; - *buf += strcspn(*buf, "\n") + 1; + *buf += strcspn(*buf, "\n"); + *buf += !!**buf; return start; } - *buf += strcspn(*buf, "\n") + 1; + *buf += strcspn(*buf, "\n"); + *buf += !!**buf; } return AV_NOPTS_VALUE; }