XSPF: fix realloc() integer overflow

[vlc] / modules / demux / playlist / asx.c

diff --git a/modules/demux/playlist/asx.c b/modules/demux/playlist/asx.c
index 2c3736ff5a0544e46bd543a87158844f6bb55671..caf85771d9743e63cc197198f26a9287cc66a619 100644 (file)
--- a/modules/demux/playlist/asx.c
+++ b/modules/demux/playlist/asx.c
@@ -210,7 +210,8 @@ int Import_ASX( vlc_object_t *p_this )
     p_demux->p_sys->psz_data = NULL;
     p_demux->p_sys->i_data_len = -1;
     p_demux->p_sys->b_utf8 = false;
-    p_demux->p_sys->b_skip_ads = config_GetInt( p_demux, "playlist-skip-ads" );
+    p_demux->p_sys->b_skip_ads =
+        var_InheritBool( p_demux, "playlist-skip-ads" );
 
     return VLC_SUCCESS;
 }
@@ -260,6 +261,8 @@ static int Demux( demux_t *p_demux )
         if( p_sys->i_data_len <= 0 ) return -1;
     }
 
+    input_item_node_t *p_subitems = input_item_node_Create( p_current_input );
+
     psz_parse = p_sys->psz_data;
     /* Find first element */
     if( ( psz_parse = strcasestr( psz_parse, "<ASX" ) ) )
@@ -290,6 +293,10 @@ static int Demux( demux_t *p_demux )
 
         psz_parse = strcasestr( psz_parse, ">" );
 
+        /* counter for single ad item */
+        input_item_t *uniq_entry_ad_backup = NULL;
+        int i_inserted_entries = 0;
+
         while( psz_parse && ( psz_parse = strcasestr( psz_parse, "<" ) ) )
         {
             if( !strncasecmp( psz_parse, "<!--", 4 ) )
@@ -432,11 +439,15 @@ static int Demux( demux_t *p_demux )
                     }
                     else continue;
                 }
-                if( ( psz_parse = strcasestr( psz_parse, "/>" ) ) )
-                    psz_parse += 2;
-                else if( ( psz_parse = strcasestr( psz_parse, "</MoreInfo>") ) )
-                    psz_parse += 11;
-                else continue;
+                if( ( psz_backup = strcasestr( psz_parse, "/>" ) ) )
+                    psz_parse = psz_backup + 2;
+                else if( ( psz_backup = strcasestr( psz_parse, "</MoreInfo>") ) )
+                    psz_parse = psz_backup + 11;
+                else
+                {
+                    psz_parse = NULL;
+                    continue;
+                }
             }
             else if( !strncasecmp( psz_parse, "<ABSTRACT>", 10 ) )
             {
@@ -466,7 +477,7 @@ static int Demux( demux_t *p_demux )
                             input_item_t *p_input;
                             p_input = input_item_New( p_demux, psz_string, psz_title_asx );
                             input_item_CopyOptions( p_current_input, p_input );
-                            input_item_AddSubItem( p_current_input, p_input );
+                            input_item_node_AppendItem( p_subitems, p_input );
                             vlc_gc_decref( p_input );
                             free( psz_string );
                         }
@@ -476,7 +487,6 @@ static int Demux( demux_t *p_demux )
                 }
                 if( ( psz_parse = strcasestr( psz_parse, "/>" ) ) )
                     psz_parse += 2;
-                else continue;
             }
             else if( !strncasecmp( psz_parse, "</Entry>", 8 ) )
             {
@@ -499,11 +509,10 @@ static int Demux( demux_t *p_demux )
                     msg_Err( p_demux, "entry without href?" );
                     continue;
                 }
-
-                if( p_sys->b_skip_ads && b_skip_entry )
+                /* An skip entry is an ad only if other entries exist without skip */
+                if( p_sys->b_skip_ads && b_skip_entry && i_inserted_entries != 0 )
                 {
                     char *psz_current_input_name = input_item_GetName( p_current_input );
-
                     msg_Dbg( p_demux, "skipped entry %d %s (%s)",
                              i_entry_count,
                              ( psz_title_entry ? psz_title_entry : psz_current_input_name ), psz_href );
@@ -551,8 +560,23 @@ static int Demux( demux_t *p_demux )
                         if( psz_copyright_entry ) input_item_SetCopyright( p_entry, psz_copyright_entry );
                         if( psz_moreinfo_entry ) input_item_SetURL( p_entry, psz_moreinfo_entry );
                         if( psz_abstract_entry ) input_item_SetDescription( p_entry, psz_abstract_entry );
-                        input_item_AddSubItem( p_current_input, p_entry );
-                        vlc_gc_decref( p_entry );
+
+                        i_inserted_entries++;
+                        if( p_sys->b_skip_ads && b_skip_entry )
+                        {
+                            // We put the entry as a backup for unique ad case
+                            uniq_entry_ad_backup = p_entry;
+                        }
+                        else
+                        {
+                            if( uniq_entry_ad_backup != NULL )
+                            {
+                                vlc_gc_decref( uniq_entry_ad_backup );
+                                uniq_entry_ad_backup = NULL;
+                            }
+                            input_item_node_AppendItem( p_subitems, p_entry );
+                            vlc_gc_decref( p_entry );
+                        }
                     }
                     free( psz_current_input_name );
                 }
@@ -627,7 +651,7 @@ static int Demux( demux_t *p_demux )
                                 if( psz_copyright_entry ) input_item_SetCopyright( p_entry, psz_copyright_entry );
                                 if( psz_moreinfo_entry ) input_item_SetURL( p_entry, psz_moreinfo_entry );
                                 if( psz_abstract_entry ) input_item_SetDescription( p_entry, psz_abstract_entry );
-                                input_item_AddSubItem( p_current_input, p_entry );
+                                input_item_node_AppendItem( p_subitems, p_entry );
                                 vlc_gc_decref( p_entry );
                             }
 
@@ -726,6 +750,13 @@ static int Demux( demux_t *p_demux )
             }
             else psz_parse++;
         }
+        if ( uniq_entry_ad_backup != NULL )
+        {
+            msg_Dbg( p_demux, "added unique entry even if ad");
+            /* If ASX contains a unique entry, we add it, it is probably not an ad */
+            input_item_node_AppendItem( p_subitems, uniq_entry_ad_backup );
+            vlc_gc_decref( uniq_entry_ad_backup);
+        }
 #if 0
 /* FIXME Unsupported elements */
             PARAM
@@ -735,6 +766,9 @@ static int Demux( demux_t *p_demux )
             STARTMARK
 #endif
     }
+
+    input_item_node_PostAndDelete( p_subitems );
+
     vlc_gc_decref(p_current_input);
     return 0; /* Needed for correct operation of go back */
 }