[vlc-commits] subtitle: Fix potential heap buffer overflow

[Hugo Beauzée-Luyssen]

vlc | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Fri Apr 28 13:56:46 2017 +0200| [f2b1f9e3538fc30ecc22b90bcb4300f68d703d30] | committer: Hugo Beauzée-Luyssen

subtitle: Fix potential heap buffer overflow

Reported-by: Yannay Livneh <yannayl at checkpoint.com>
             Omri Herscovici <omrih at checkpoint.com>
             Omer Gull <omergu at checkpoint.com>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=f2b1f9e3538fc30ecc22b90bcb4300f68d703d30
---

 modules/demux/subtitle.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/demux/subtitle.c b/modules/demux/subtitle.c
index 5e4fcdb7f2..9726bc26bb 100644
--- a/modules/demux/subtitle.c
+++ b/modules/demux/subtitle.c
@@ -1908,8 +1908,8 @@ static int ParseJSS( vlc_object_t *p_obj, subs_properties_t *p_props,
             if( (*(psz_text + 1 ) ) == '~' || (*(psz_text + 1 ) ) == '{' ||
                 (*(psz_text + 1 ) ) == '\\' )
                 psz_text++;
-            else if( *(psz_text + 1 ) == '\r' ||  *(psz_text + 1 ) == '\n' ||
-                     *(psz_text + 1 ) == '\0' )
+            else if( ( *(psz_text + 1 ) == '\r' ||  *(psz_text + 1 ) == '\n' ) &&
+                     *(psz_text + 1 ) != '\0' )
             {
                 psz_text++;
             }