[vlc-commits] url: fix out-of-bound read

[Rémi Denis-Courmont]

vlc/vlc-2.2 | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Aug 22 23:04:39 2014 +0300| [96b91c15493371b7499b8ad9a33d4c10b232fc5b] | committer: Rémi Denis-Courmont

url: fix out-of-bound read

...if *next is '\0'.

(cherry picked from commit 48677cbcc5058b5c9c8ee533dcc78ad16c6503c9)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=96b91c15493371b7499b8ad9a33d4c10b232fc5b
---

 src/text/url.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/text/url.c b/src/text/url.c
index 3492a54..cd7e488 100644
--- a/src/text/url.c
+++ b/src/text/url.c
@@ -412,7 +412,7 @@ void vlc_UrlParse (vlc_url_t *restrict url, const char *str, unsigned char opt)
     /* URL scheme */
     next = buf;
     while ((*next >= 'A' && *next <= 'Z') || (*next >= 'a' && *next <= 'z')
-        || (*next >= '0' && *next <= '9') || (strchr ("+-.", *next) != NULL))
+        || (*next >= '0' && *next <= '9') || memchr ("+-.", *next, 3) != NULL)
         next++;
     /* This is not strictly correct. In principles, the scheme is always
      * present in an absolute URL and followed by a colon. Depending on the