structure: don't overread input when searching for "

When searching for the string terminator don't read past the ending
0-byte when escaping characters.
Add unit test for various escaping cases.

2 files changed, 22 insertions, 2 deletions

diff --git a/gst/gststructure.c b/gst/gststructure.c
index 876862e53..10ac568fb 100644
--- a/gst/gststructure.c
+++ b/gst/gststructure.c
@@ -1928,8 +1928,11 @@ gst_structure_parse_string (gchar * s, gchar ** end, gchar ** next,
     while (*s != '"') {
       if (G_UNLIKELY (*s == 0))
         return FALSE;
-      if (G_UNLIKELY (*s == '\\'))
+      if (G_UNLIKELY (*s == '\\')) {
         s++;
+        if (G_UNLIKELY (*s == 0))
+          return FALSE;
+      }
       *w = *s;
       w++;
       s++;
@@ -1941,8 +1944,11 @@ gst_structure_parse_string (gchar * s, gchar ** end, gchar ** next,
     while (*s != '"') {
       if (G_UNLIKELY (*s == 0))
         return FALSE;
-      if (G_UNLIKELY (*s == '\\'))
+      if (G_UNLIKELY (*s == '\\')) {
         s++;
+        if (G_UNLIKELY (*s == 0))
+          return FALSE;
+      }
       s++;
     }
     s++;
diff --git a/tests/check/gst/gststructure.c b/tests/check/gst/gststructure.c
index 58ee81922..d1fb80173 100644
--- a/tests/check/gst/gststructure.c
+++ b/tests/check/gst/gststructure.c
@@ -174,6 +174,20 @@ GST_START_TEST (test_from_string)
   ASSERT_WARNING (structure = gst_structure_from_string (s, NULL));
   fail_if (structure == NULL, "Could not get structure from string %s", s);
   gst_structure_free (structure);
+
+  /* make sure we handle \ as last character in various things, run with valgrind */
+  s = "foo,test=\"foobar\\";
+  structure = gst_structure_from_string (s, NULL);
+  fail_unless (structure == NULL);
+  s = "\\";
+  structure = gst_structure_from_string (s, NULL);
+  fail_unless (structure == NULL);
+  s = "foobar,test\\";
+  structure = gst_structure_from_string (s, NULL);
+  fail_unless (structure == NULL);
+  s = "foobar,test=(string)foo\\";
+  structure = gst_structure_from_string (s, NULL);
+  fail_unless (structure == NULL);
 }
 
 GST_END_TEST;