From 7137afeb2c466135ab0e01ee0f9cbd2abd000563 Mon Sep 17 00:00:00 2001
From: Kevin Mitchell <kevmitch@gmail.com>
Date: Thu, 17 Dec 2015 01:40:31 -0800
Subject: demux: check embedded cuesheet refers to only one file

If someone was "clever" enough to embed a cuesheet
referencing multiple files, mpv would create a bunch
of nonsense chapter markers.
---
 demux/cue.c   | 15 +++++++++++++++
 demux/cue.h   |  1 +
 demux/demux.c | 13 +++++++++----
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/demux/cue.c b/demux/cue.c
index d72e84249b..50ce4b7639 100644
--- a/demux/cue.c
+++ b/demux/cue.c
@@ -218,3 +218,18 @@ struct cue_file *mp_parse_cue(struct bstr data)
 
     return f;
 }
+
+int mp_check_embedded_cue(struct cue_file *f)
+{
+    char *fn0 = f->tracks[0].filename;
+    for (int n = 1; n < f->num_tracks; n++) {
+        char *fn = f->tracks[n].filename;
+        // both filenames have the same address (including NULL)
+        if (fn0 == fn)
+            continue;
+        // only one filename is NULL, or the strings don't match
+        if (!fn0 || !fn || strcmp(fn0, fn) != 0)
+            return -1;
+    }
+    return 0;
+}
diff --git a/demux/cue.h b/demux/cue.h
index cf4b4c1a08..1ae5f0a203 100644
--- a/demux/cue.h
+++ b/demux/cue.h
@@ -38,5 +38,6 @@ struct cue_track {
 
 bool mp_probe_cue(struct bstr data);
 struct cue_file *mp_parse_cue(struct bstr data);
+int mp_check_embedded_cue(struct cue_file *f);
 
 #endif
diff --git a/demux/demux.c b/demux/demux.c
index dcad692be5..972bf31bae 100644
--- a/demux/demux.c
+++ b/demux/demux.c
@@ -926,10 +926,15 @@ static void demux_init_cuesheet(struct demuxer *demuxer)
     if (cue && !demuxer->num_chapters) {
         struct cue_file *f = mp_parse_cue(bstr0(cue));
         if (f) {
-            for (int n = 0; n < f->num_tracks; n++) {
-                struct cue_track *t = &f->tracks[n];
-                int idx = demuxer_add_chapter(demuxer, "", t->start, -1);
-                mp_tags_merge(demuxer->chapters[idx].metadata, t->tags);
+            if (mp_check_embedded_cue(f) < 0) {
+                MP_WARN(demuxer, "Embedded cue sheet references more than one file. "
+                        "Ignoring it.\n");
+            } else {
+                for (int n = 0; n < f->num_tracks; n++) {
+                    struct cue_track *t = &f->tracks[n];
+                    int idx = demuxer_add_chapter(demuxer, "", t->start, -1);
+                    mp_tags_merge(demuxer->chapters[idx].metadata, t->tags);
+                }
             }
         }
         talloc_free(f);
-- 
cgit v1.2.3