From: jeanlf <jeanlf@gpac.io>
Date: Mon, 30 Aug 2021 14:57:38 +0000 (+0200)
Subject: [PATCH] fixed #1897
X-Git-Tag: archive/raspbian/1.0.1+dfsg1-4+rpi1+deb11u3^2~77
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=c8b4a3fa1c68276f4adc3ae185e9085362998199;p=gpac.git

[PATCH] fixed #1897


Gbp-Pq: Name CVE-2021-40574.patch
---

diff --git a/src/filters/load_text.c b/src/filters/load_text.c
index a528b5b..9447647 100644
--- a/src/filters/load_text.c
+++ b/src/filters/load_text.c
@@ -233,7 +233,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 {
 	u32 i, j, len;
 	char *sOK;
-	char szLineConv[1024];
+	char szLineConv[2048];
 	unsigned short *sptr;
 
 	memset(szLine, 0, sizeof(char)*lineSize);
@@ -305,7 +305,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 		}
 	}
 	sptr = (u16 *)szLine;
-	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/
@@ -1795,6 +1795,8 @@ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx)
 		while (szLine[i+1] && szLine[i+1]!='}') {
 			szTime[i] = szLine[i+1];
 			i++;
+			if (i>=19)
+				break;
 		}
 		szTime[i] = 0;
 		ctx->start = atoi(szTime);