VLC_VariableSet: assume unsafe variable settings. Fixes #1371.

diff --git a/src/libvlc.c b/src/libvlc.c
index e8d3a4f6439a97b1c18601bd30c02fb35bfe1274..fa9bbf9deb8f42dc0118c473f0f39f3e4f710cbd 100644 (file)
--- a/src/libvlc.c
+++ b/src/libvlc.c
@@ -188,7 +188,7 @@ int VLC_Destroy( int i_object )
 }
 
 /*****************************************************************************
- * VLC_VariableSet: set a vlc variable
+ * VLC_VariableSet: set a "safe" vlc variable
  *****************************************************************************/
 int VLC_VariableSet( int i_object, char const *psz_var, vlc_value_t value )
 {
@@ -206,6 +206,11 @@ int VLC_VariableSet( int i_object, char const *psz_var, vlc_value_t value )
 
         if( p_item )
         {
+            /* VLC_VariableSet is only used from the browser plugins, so we
+             *  can pretty much assume that the input is _not_ trusted. */
+            if( !p_item->b_safe )
+                return VLC_EGENERIC;
+
             switch( p_item->i_type )
             {
                 case CONFIG_ITEM_BOOL: