srtdec: make sure we don't write past the end of buffer
authorAurelien Jacobs <aurel@gnuage.org>
Fri, 25 Mar 2011 00:02:53 +0000 (01:02 +0100)
committerAurelien Jacobs <aurel@gnuage.org>
Fri, 25 Mar 2011 00:02:53 +0000 (01:02 +0100)
Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
libavcodec/srtdec.c

index af03cc4..701100a 100644 (file)
@@ -94,7 +94,7 @@ static const char *srt_to_ass(AVCodecContext *avctx, char *out, char *out_end,
             break;
         case '<':
             tag_close = in[1] == '/';
-            if (sscanf(in+tag_close+1, "%128[^>]>%n%c", buffer, &len,&c) >= 2) {
+            if (sscanf(in+tag_close+1, "%127[^>]>%n%c", buffer, &len,&c) >= 2) {
                 if ((param = strchr(buffer, ' ')))
                     *param++ = 0;
                 if ((!tag_close && sptr < FF_ARRAY_ELEMS(stack)) ||