[FFmpeg-devel] [PATCH] avcodec/htmlsubtitles: Be a bit more picky on syntax

[Michael Niedermayer]

On Fri, May 26, 2017 at 01:08:54PM +0200, wm4 wrote:
> On Thu, 25 May 2017 19:32:06 +0200
> Michael Niedermayer <michael at niedermayer.cc> wrote:
> 
> > This reduces the number of strstr() calls per byte
> > 
> > Fixes timeout
> > Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/htmlsubtitles.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/libavcodec/htmlsubtitles.c b/libavcodec/htmlsubtitles.c
> > index 16295daa0c..e69681f31c 100644
> > --- a/libavcodec/htmlsubtitles.c
> > +++ b/libavcodec/htmlsubtitles.c
> > @@ -92,7 +92,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
> >          case '<':
> >              tag_close = in[1] == '/';
> >              len = 0;
> > -            if (sscanf(in+tag_close+1, "%127[^>]>%n", buffer, &len) >= 1 && len > 0) {
> > +            if (sscanf(in+tag_close+1, "%127[^<>]>%n", buffer, &len) >= 1 && len > 0) {
> >                  const char *tagname = buffer;
> >                  while (*tagname == ' ')
> >                      tagname++;
> > @@ -149,7 +149,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in)
> >                          }
> >                      } else if (tagname[0] && !tagname[1] && strspn(tagname, "bisu") == 1) {
> >                          av_bprintf(dst, "{\\%c%d}", tagname[0], !tag_close);
> > -                    } else {
> > +                    } else if (*tagname) {
> >                          unknown = 1;
> >                          snprintf(tmp, sizeof(tmp), "</%s>", tagname);
> >                      }
> 
> Does it change semantics, and how?

it disallows '<' in tags, like <ab<cd<<ef>
it also disallows empty tags like '< >'

ill send a slighty better patch that blocks the empty ones earlier

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Does the universe only have a finite lifespan? No, its going to go on
forever, its just that you wont like living in it. -- Hiranya Peiri
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170701/e769e01c/attachment.sig>