From ec10b764b9bacc82e69dfb775736c3feb237b9ef Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Mon, 8 Mar 2010 23:04:26 +0100
Subject: [PATCH] caps: Fail when fractions are followed by random text

Previous code treated "1/1yourmom" the same as "1/1" and "1wimsmom" the
same as "1". Now the code is stricter and will fail to convert a
fraction when followed by garbage text.
---
 gst/gstvalue.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/gst/gstvalue.c b/gst/gstvalue.c
index d9bad01e57..2a165ab243 100644
--- a/gst/gstvalue.c
+++ b/gst/gstvalue.c
@@ -3685,6 +3685,7 @@ static gboolean
 gst_value_deserialize_fraction (GValue * dest, const gchar * s)
 {
   gint num, den;
+  int num_chars;
 
   if (G_UNLIKELY (s == NULL))
     return FALSE;
@@ -3692,19 +3693,20 @@ gst_value_deserialize_fraction (GValue * dest, const gchar * s)
   if (G_UNLIKELY (dest == NULL || !GST_VALUE_HOLDS_FRACTION (dest)))
     return FALSE;
 
-  if (sscanf (s, "%d/%d", &num, &den) == 2) {
+  if (sscanf (s, "%d/%d%n", &num, &den, &num_chars) >= 2) {
+    if (s[num_chars] != 0)
+      return FALSE;
     gst_value_set_fraction (dest, num, den);
     return TRUE;
-  }
-  if (g_ascii_strcasecmp (s, "1/max") == 0) {
+  } else if (g_ascii_strcasecmp (s, "1/max") == 0) {
     gst_value_set_fraction (dest, 1, G_MAXINT);
     return TRUE;
-  }
-  if (sscanf (s, "%d", &num) == 1) {
+  } else if (sscanf (s, "%d%n", &num, &num_chars) >= 1) {
+    if (s[num_chars] != 0)
+      return FALSE;
     gst_value_set_fraction (dest, num, 1);
     return TRUE;
-  }
-  if (g_ascii_strcasecmp (s, "min") == 0) {
+  } else if (g_ascii_strcasecmp (s, "min") == 0) {
     gst_value_set_fraction (dest, -G_MAXINT, 1);
     return TRUE;
   } else if (g_ascii_strcasecmp (s, "max") == 0) {