[vlc-commits] webvtt: Fix potential OOB read

[Hugo Beauzée-Luyssen]

vlc/vlc-3.0 | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Tue Mar  5 15:11:22 2019 +0100| [fc62b4d2827fdd79a91f008d50cb4d3e70123ca3] | committer: Hugo Beauzée-Luyssen

webvtt: Fix potential OOB read

https://hackerone.com/reports/503663

(cherry picked from commit ca3eb137460db80cf50c145242606157cde50a96)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=fc62b4d2827fdd79a91f008d50cb4d3e70123ca3
---

 modules/codec/webvtt/webvtt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/codec/webvtt/webvtt.c b/modules/codec/webvtt/webvtt.c
index ac78d1968b..76f2aee8ef 100644
--- a/modules/codec/webvtt/webvtt.c
+++ b/modules/codec/webvtt/webvtt.c
@@ -242,7 +242,7 @@ void webvtt_text_parser_Feed( webvtt_text_parser_t *p, char *psz_line )
             if( webvtt_scan_time( p->reads[1], &i_start ) &&
                 webvtt_scan_time( psz_split + 5,  &i_stop ) && i_start <= i_stop )
             {
-                const char *psz_attrs = strchr( psz_split + 5 + 9, ' ' );
+                const char *psz_attrs = strchr( psz_split + 5 + 5, ' ' );
                 p->p_cue = ( p->pf_get_cue ) ? p->pf_get_cue( p->priv ) : NULL;
                 if( p->p_cue )
                 {