summaryrefslogtreecommitdiffstats
path: root/sub/filter_sdh.c
diff options
context:
space:
mode:
authorDudemanguy <random342@airmail.cc>2024-01-12 20:03:50 -0600
committerDudemanguy <random342@airmail.cc>2024-01-12 20:45:40 -0600
commite15b2b19a3548c8c210d86a77b52d495494a1e20 (patch)
tree39baaf161a7bbec3bce06323da2a74b7d573e22a /sub/filter_sdh.c
parent431b420dd6a3e8dc14a3792824a25b5599bfeef2 (diff)
downloadmpv-e15b2b19a3548c8c210d86a77b52d495494a1e20.tar.bz2
mpv-e15b2b19a3548c8c210d86a77b52d495494a1e20.tar.xz
filter_sdh: sanitize get_char_bytes heuristic to avoid overflow
There's a simple check in filter_sdh that gets the bytes of the first character in a string in order to do pointer arthimetic to filter the string. The problem is that it is possible for the amount of bytes to be greater than the actual length of the string for certain unicode characters. This can't be worked with so enforce the strlen as the absolute minimum here to avoid overflow situations. Fixes #13237.
Diffstat (limited to 'sub/filter_sdh.c')
-rw-r--r--sub/filter_sdh.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sub/filter_sdh.c b/sub/filter_sdh.c
index da5337d850..0a1d36749e 100644
--- a/sub/filter_sdh.c
+++ b/sub/filter_sdh.c
@@ -72,13 +72,13 @@ static int get_char_bytes(char *str)
// using anything else anyway.
if (str && str[0]) {
if (!(str[0] >> 7 & 1)) {
- return 1;
+ return MPMIN(strlen(str), 1);
} else if (!(str[0] >> 5 & 1)) {
- return 2;
+ return MPMIN(strlen(str), 2);
} else if (!(str[0] >> 4 & 1)) {
- return 3;
+ return MPMIN(strlen(str), 3);
} else if (!(str[0] >> 3 & 1)) {
- return 4;
+ return MPMIN(strlen(str), 4);
}
}
return 0;