Fix a buffer overflow

Reported by Drew Yao

diff --git a/modules/codec/subtitles/subsdec.c b/modules/codec/subtitles/subsdec.c
index a810d5801990ed115a387bb55e9092eac43eb337..0d5081d059bd4ca4c96bf5fbc2e7f941d0c49777 100644 (file)
--- a/modules/codec/subtitles/subsdec.c
+++ b/modules/codec/subtitles/subsdec.c
@@ -572,7 +572,7 @@ static char *StripTags( char *psz_subtitle )
  */
 static char *CreateHtmlSubtitle( char *psz_subtitle )
 {
-    char    psz_tagStack[ 100 ];
+    char    psz_tagStack[ ( strlen( psz_subtitle ) / 3 ) + 1 ];
     size_t  i_buf_size     = strlen( psz_subtitle ) + 100;
     char   *psz_html_start = malloc( i_buf_size );