From: John Stebbins <jstebbins.hb@gmail.com>
Date: Sun, 6 Jan 2019 17:31:44 +0000 (-0700)
Subject: decssasub: fix crash when filename is invalid
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e81aa4f4d29daad15a5117940a510f32557ae2d1;p=handbrake

decssasub: fix crash when filename is invalid
---

diff --git a/libhb/decssasub.c b/libhb/decssasub.c
index 331a2b0fd..5d0b4a3b3 100644
--- a/libhb/decssasub.c
+++ b/libhb/decssasub.c
@@ -233,8 +233,9 @@ static int extradataInit( hb_work_private_t * pv )
 
     while (1)
     {
-        char   * line = NULL;
-        size_t   len, size = 0;
+        char    * line = NULL;
+        ssize_t   len;
+        size_t    size = 0;
 
         len = getline(&line, &size, pv->file);
         if (len < 0)
@@ -243,7 +244,7 @@ static int extradataInit( hb_work_private_t * pv )
             free(header);
             return 1;
         }
-        if (len > 0)
+        if (len > 0 && line != NULL)
         {
             if (header != NULL)
             {
@@ -255,23 +256,22 @@ static int extradataInit( hb_work_private_t * pv )
             {
                 header = strdup(line);
             }
-        }
-        if (!events)
-        {
-            if (len >= events_len && !strncasecmp(line, events_tag, events_len))
-            {
-                events = 1;
-            }
-        }
-        else
-        {
-            if (len >= format_len && !strncasecmp(line, format_tag, format_len))
+            if (!events)
             {
-                free(line);
-                break;
+                if (len >= events_len &&
+                    !strncasecmp(line, events_tag, events_len))
+                {
+                    events = 1;
+                }
             }
-            if (len > 0)
+            else
             {
+                if (len >= format_len &&
+                    !strncasecmp(line, format_tag, format_len))
+                {
+                    free(line);
+                    break;
+                }
                 // Improperly formatted SSA header
                 free(header);
                 return 1;
@@ -468,11 +468,12 @@ static hb_buffer_t * ssa_read( hb_work_private_t * pv )
 
     while (!feof(pv->file))
     {
-        char   * line = NULL;
-        size_t   len, size = 0;
+        char    * line = NULL;
+        ssize_t   len;
+        size_t    size = 0;
 
         len = getline(&line, &size, pv->file);
-        if (len > 0)
+        if (len > 0 && line != NULL)
         {
             out = decode_line_to_mkv_ssa(pv, line, len);
             if (out != NULL)