From a795b2039b013f4ccfca2de76bd892ac77e49be1 Mon Sep 17 00:00:00 2001
From: Erik Hovland <erik@hovland.org>
Date: Mon, 14 Apr 2008 21:19:36 +0100
Subject: Title array has only five entries. It can be overrun.

---
 src/libsputext/demux_sputext.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/libsputext/demux_sputext.c b/src/libsputext/demux_sputext.c
index ee7f6122e..c80e2b496 100644
--- a/src/libsputext/demux_sputext.c
+++ b/src/libsputext/demux_sputext.c
@@ -902,7 +902,10 @@ static subtitle_t *sub_read_line_jacobsub(demux_sputext_t *this, subtitle_t *cur
 	    }
 	}
 	*q = '\0';
-	current->text[current->lines] = strdup(line1);
+        if (current->lines < SUB_MAX_TEXT)
+	    current->text[current->lines] = strdup(line1);
+        else
+            xprintf (this->stream->xine, XINE_VERBOSITY_DEBUG, "Too many lines in a subtitle\n");
     }
     current->lines++;
     return current;
-- 
cgit v1.2.3