subparse: Look for the closing > of a tag after the opening <

Previously when fixing up subrip markip, we were looking from the start
of the remaining buffer instead. Due to how skipping over closing tags
works, the remaining buffer will still contain the closing `>` of the
previous tag so if a unexpected closing tag is found after another
closing tag, we would potentially do an out of bounds memmove().

Fixes ZDI-CAN-20968
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2662

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4900>
This commit is contained in:
Sebastian Dröge 2023-06-13 12:53:13 +03:00 committed by GStreamer Marge Bot
parent b9a357db5a
commit 7632b0c2a0

View file

@ -778,7 +778,7 @@ subrip_fix_up_markup (gchar ** p_txt, gconstpointer allowed_tags_ptr)
}
if (*next_tag == '<' && *(next_tag + 1) == '/') {
end_tag = strchr (cur, '>');
end_tag = strchr (next_tag, '>');
if (end_tag) {
const gchar *last = NULL;
if (num_open_tags > 0)