VLC播放器載入惡意字幕文件導致執行任意代碼漏洞分析與POC實現

demux_sys_t *p_sys = p_demux->p_sys;
text_t *txt = &p_sys->txt;
char *psz_text, *psz_orig;
char *psz_text2, *psz_orig2;
int h1, h2, m1, m2, s1, s2, f1, f2;

if( !p_sys->jss.b_inited )
{
p_sys->jss.i_comment = 0;
p_sys->jss.i_time_resolution = 30;
p_sys->jss.i_time_shift = 0;

p_sys->jss.b_inited = true;
}

/* Parse the main lines */
for( ;; )
{
const char *s = TextGetLine( txt );
if( !s )
return VLC_EGENERIC;

psz_orig = malloc( strlen( s ) + 1 );
if( !psz_orig )
return VLC_ENOMEM;
psz_text = psz_orig;

/* Complete time lines */
if( sscanf( s, "%d:%d:%d.%d %d:%d:%d.%d %[^

]",
&h1, &m1, &s1, &f1, &h2, &m2, &s2, &f2, psz_text ) == 9 )
{
p_subtitle->i_start = ( (int64_t)( h1 *3600 + m1 * 60 + s1 ) +
(int64_t)( ( f1 + p_sys->jss.i_time_shift ) / p_sys->jss.i_time_resolution ) )
* 1000000;
p_subtitle->i_stop = ( (int64_t)( h2 *3600 + m2 * 60 + s2 ) +
(int64_t)( ( f2 + p_sys->jss.i_time_shift ) / p_sys->jss.i_time_resolution ) )
* 1000000;
break;
}
/* Short time lines */
else if( sscanf( s, "@%d @%d %[^

]", &f1, &f2, psz_text ) == 3 )
{
p_subtitle->i_start = (int64_t)(
( f1 + p_sys->jss.i_time_shift ) / p_sys->jss.i_time_resolution * 1000000.0 );
p_subtitle->i_stop = (int64_t)(
( f2 + p_sys->jss.i_time_shift ) / p_sys->jss.i_time_resolution * 1000000.0 );
break;
}
/* General Directive lines */
/* Only TIME and SHIFT are supported so far */
else if( s[0] == "#" )
{
int h = 0, m =0, sec = 1, f = 1;
unsigned shift = 1;
int inv = 1;

strcpy( psz_text, s );

switch( toupper( (unsigned char)psz_text[1] ) )
{
case "S":
shift = isalpha( (unsigned char)psz_text[2] ) ? 6 : 2 ;

if( sscanf( &psz_text[shift], "%d", &h ) )
{
/* Negative shifting */
if( h < 0 ) { h *= -1; inv = -1; } if( sscanf( &psz_text[shift], "%*d:%d", &m ) ) { if( sscanf( &psz_text[shift], "%*d:%*d:%d", &sec ) ) { sscanf( &psz_text[shift], "%*d:%*d:%*d.%d", &f ); } else { h = 0; sscanf( &psz_text[shift], "%d:%d.%d", &m, &sec, &f ); m *= inv; } } else { h = m = 0; sscanf( &psz_text[shift], "%d.%d", &sec, &f); sec *= inv; } p_sys->jss.i_time_shift = ( ( h * 3600 + m * 60 + sec )
* p_sys->jss.i_time_resolution + f ) * inv;
}
break;

case "T":
shift = isalpha( (unsigned char)psz_text[2] ) ? 8 : 2 ;

sscanf( &psz_text[shift], "%d", &p_sys->jss.i_time_resolution );
break;
}
free( psz_orig );
continue;
}
else
/* Unkown type line, probably a comment */
{
free( psz_orig );
continue;
}
}

while( psz_text[ strlen( psz_text ) - 1 ] == "\" )
{
const char *s2 = TextGetLine( txt );

if( !s2 )
{
free( psz_orig );
return VLC_EGENERIC;
}

int i_len = strlen( s2 );
if( i_len == 0 )
break;

int i_old = strlen( psz_text );

psz_text = realloc_or_free( psz_text, i_old + i_len + 1 );
if( !psz_text )
return VLC_ENOMEM;

psz_orig = psz_text;
strcat( psz_text, s2 );
}

/* Skip the blanks */
while( *psz_text == " " || *psz_text == " " ) psz_text++;

/* Parse the directives */
if( isalpha( (unsigned char)*psz_text ) || *psz_text == "[" )
{
while( *psz_text != " " )
{ psz_text++ ;};

/* Directives are NOT parsed yet */
/* This has probably a better place in a decoder ? */
/* directive = malloc( strlen( psz_text ) + 1 );
if( sscanf( psz_text, "%s %[^

]", directive, psz_text2 ) == 2 )*/
}

/* Skip the blanks after directives */
while( *psz_text == " " || *psz_text == " " ) psz_text++;

/* Clean all the lines from inline comments and other stuffs */
psz_orig2 = calloc( strlen( psz_text) + 1, 1 );
psz_text2 = psz_orig2;

for( ; *psz_text != "" && *psz_text != "
" && *psz_text != "
"; )
{
switch( *psz_text )
{
case "{":
p_sys->jss.i_comment++;
break;
case "}":
if( p_sys->jss.i_comment )
{
p_sys->jss.i_comment = 0;
if( (*(psz_text + 1 ) ) == " " ) psz_text++;
}
break;
case "~":
if( !p_sys->jss.i_comment )
{
*psz_text2 = " ";
psz_text2++;
}
break;
case " ":
case " ":
if( (*(psz_text + 1 ) ) == " " || (*(psz_text + 1 ) ) == " " )
break;
if( !p_sys->jss.i_comment )
{
*psz_text2 = " ";
psz_text2++;
}
break;
case "\":
if( (*(psz_text + 1 ) ) == "n" )
{
*psz_text2 = "
";
psz_text++;
psz_text2++;
break;
}
if( ( toupper((unsigned char)*(psz_text + 1 ) ) == "C" ) ||
( toupper((unsigned char)*(psz_text + 1 ) ) == "F" ) )
{
psz_text++; psz_text++;
break;
}
if( (*(psz_text + 1 ) ) == "B" || (*(psz_text + 1 ) ) == "b" ||
(*(psz_text + 1 ) ) == "I" || (*(psz_text + 1 ) ) == "i" ||
(*(psz_text + 1 ) ) == "U" || (*(psz_text + 1 ) ) == "u" ||
(*(psz_text + 1 ) ) == "D" || (*(psz_text + 1 ) ) == "N" )
{
psz_text++;
break;
}
if( (*(psz_text + 1 ) ) == "~" || (*(psz_text + 1 ) ) == "{" ||
(*(psz_text + 1 ) ) == "\" )
psz_text++;
else if( *(psz_text + 1 ) == "
" || *(psz_text + 1 ) == "
" ||
*(psz_text + 1 ) == "" )
{
psz_text++;
}
break;
default:
if( !p_sys->jss.i_comment )
{
*psz_text2 = *psz_text;
psz_text2++;
}
}
psz_text++;
}