| Message ID | 20170525173206.27425-1-michael@niedermayer.cc |
|---|---|
| State | Superseded |
| Headers | show |
On Thu, 25 May 2017 19:32:06 +0200 Michael Niedermayer <michael@niedermayer.cc> wrote: > This reduces the number of strstr() calls per byte > > Fixes timeout > Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/htmlsubtitles.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/htmlsubtitles.c b/libavcodec/htmlsubtitles.c > index 16295daa0c..e69681f31c 100644 > --- a/libavcodec/htmlsubtitles.c > +++ b/libavcodec/htmlsubtitles.c > @@ -92,7 +92,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) > case '<': > tag_close = in[1] == '/'; > len = 0; > - if (sscanf(in+tag_close+1, "%127[^>]>%n", buffer, &len) >= 1 && len > 0) { > + if (sscanf(in+tag_close+1, "%127[^<>]>%n", buffer, &len) >= 1 && len > 0) { > const char *tagname = buffer; > while (*tagname == ' ') > tagname++; > @@ -149,7 +149,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) > } > } else if (tagname[0] && !tagname[1] && strspn(tagname, "bisu") == 1) { > av_bprintf(dst, "{\\%c%d}", tagname[0], !tag_close); > - } else { > + } else if (*tagname) { > unknown = 1; > snprintf(tmp, sizeof(tmp), "</%s>", tagname); > } Does it change semantics, and how?
On Fri, May 26, 2017 at 01:08:54PM +0200, wm4 wrote: > On Thu, 25 May 2017 19:32:06 +0200 > Michael Niedermayer <michael@niedermayer.cc> wrote: > > > This reduces the number of strstr() calls per byte > > > > Fixes timeout > > Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/htmlsubtitles.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/libavcodec/htmlsubtitles.c b/libavcodec/htmlsubtitles.c > > index 16295daa0c..e69681f31c 100644 > > --- a/libavcodec/htmlsubtitles.c > > +++ b/libavcodec/htmlsubtitles.c > > @@ -92,7 +92,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) > > case '<': > > tag_close = in[1] == '/'; > > len = 0; > > - if (sscanf(in+tag_close+1, "%127[^>]>%n", buffer, &len) >= 1 && len > 0) { > > + if (sscanf(in+tag_close+1, "%127[^<>]>%n", buffer, &len) >= 1 && len > 0) { > > const char *tagname = buffer; > > while (*tagname == ' ') > > tagname++; > > @@ -149,7 +149,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) > > } > > } else if (tagname[0] && !tagname[1] && strspn(tagname, "bisu") == 1) { > > av_bprintf(dst, "{\\%c%d}", tagname[0], !tag_close); > > - } else { > > + } else if (*tagname) { > > unknown = 1; > > snprintf(tmp, sizeof(tmp), "</%s>", tagname); > > } > > Does it change semantics, and how? it disallows '<' in tags, like <ab<cd<<ef> it also disallows empty tags like '< >' ill send a slighty better patch that blocks the empty ones earlier [...]
diff --git a/libavcodec/htmlsubtitles.c b/libavcodec/htmlsubtitles.c index 16295daa0c..e69681f31c 100644 --- a/libavcodec/htmlsubtitles.c +++ b/libavcodec/htmlsubtitles.c @@ -92,7 +92,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) case '<': tag_close = in[1] == '/'; len = 0; - if (sscanf(in+tag_close+1, "%127[^>]>%n", buffer, &len) >= 1 && len > 0) { + if (sscanf(in+tag_close+1, "%127[^<>]>%n", buffer, &len) >= 1 && len > 0) { const char *tagname = buffer; while (*tagname == ' ') tagname++; @@ -149,7 +149,7 @@ int ff_htmlmarkup_to_ass(void *log_ctx, AVBPrint *dst, const char *in) } } else if (tagname[0] && !tagname[1] && strspn(tagname, "bisu") == 1) { av_bprintf(dst, "{\\%c%d}", tagname[0], !tag_close); - } else { + } else if (*tagname) { unknown = 1; snprintf(tmp, sizeof(tmp), "</%s>", tagname); }
This reduces the number of strstr() calls per byte Fixes timeout Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/htmlsubtitles.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)