vlc's "Open File" dialog doesn't handle drag and drop correctly

Bug #150380 reported by Bogdan Butnaru
2
Affects Status Importance Assigned to Milestone
vlc (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: vlc

Hello! This is about VLC on Gutsy; however it probably applies to other versions too.

The "Open File..." dialog (the complete one, not the quick one) has two text fields for choosing the video and the subtitle file.

When drag-and-dropping a file on those fields, the content of the fields becomes something like:
[file:///media/jester/series/Dawson's%20Creek%2C%20season%204/(411)%20Dawson's%20Creek%20-%20The%20Tao%20of%20Dawson.avi

]
Note the line break at the end; the text fields actually display the numbers-in-a-box glyph for the 000D 000A characters (CRLF).

This is (IMO) wrong for several reasons:

(a) since the files are on the local filesystem, I think a simple path should be used (this happens if the file is picked with the "Browse" button).
(b) the CRLF thing should be simply trimmed out, along with any other surrounding whitespace. The video field isn't troubled by the CRLF, but if I don't manually delete it from the subtitle field I get an error and the subtitle doesn't load. (From the error message it's obvious that VLC incorrectly looks for the file with the CRLF characters appended, which is silly because they can't be part of a properly escaped URL like the one in the box.)
(c) I see no reason why the URL would be escaped, since it's the only thing that can be put in those fields. (The purpose of escaping is (i) to represent the URL with a certain charset and (ii) to know where it ends (ie encode the spaces), neither of which is necessary in those fields.)
(d) I just noticed that the fields accept multiple-file drops (yes, the filenames are separated with CRLF) which is kind of silly since VLC can't do anything with them. So that's probably wrong too.
(e) If I drop a file on those fields, the file's URL is _inserted_ into whatever text was already there, at the drop point. Since the result of a file drop is always a complete URL, and the fields can only handle one file, it should instead _replace_ the text that was there IMO. Note that this is only true for file drops; if I were to drop a simple piece of text, that's different, I might want to assemble a path/URL with several drops.

A different thing: I sometimes notice VLC refuses to accept drops in those fields (eg, no cursor change, nothing happens on button release); I couldn't find out what the problem is. It appears sometimes, but I can't reproduce it at others. It may be caused by some updates to underlying libraries, I don't know.

CVE References

Bogdan Butnaru (bogdanb)
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.7 KiB)

This bug was fixed in the package vlc - 0.9.2-1ubuntu1

---------------
vlc (0.9.2-1ubuntu1) intrepid; urgency=low

  * New Upstream Release, exception granted by
      - dktrkranz, norsetto, Hobbsee (via irc). LP: #270404

  Changes done in ubuntu:

  * add libxul-dev to build-depends
  * make sure that vlc is build against libxul in configure. This doesn't
    change anything in the package, but makes it more robust if building
    in an 'unclean' chroot or when modifying the package.
  * debian/control: make Vcs-* fields point to the motumedia branch
  * add libx264-dev and libass-dev to build-depends
    LP: #210354, #199870
  * actually enable libass support by passing --enable-libass to configure
  * enable libdca: add libdca-dev to build depends and --enable-libdca
  * install the x264 plugin.

  Changes already in the pkg-multimedia branch in debian:

  * don't install usr/share/vlc/mozilla in debian/mozilla-plugin-vlc.install
  * new upstream .desktop file now registers flash video mimetype LP: #261567
  * add Xb-Npp-Applications to mozilla-plugin-vlc
  * remove duplicate entries in debian/vlc-nox.install

vlc (0.9.2-1) experimental; urgency=low

  [ Christophe Mutricy ]
  * New upstream release
    + Soname changed
    + Bugs fixed upstream: Closes: #487646, #298150, #325069, #392292,
      #458004, #470903, #458004, #423121
    + new upstream fixes various crasher bugs reported in ubuntu:
      LP: #189575, #113927, #103741, #111615, #107899, #112076, #198916, 221428,
          #91679, #96978, #123589, #133528, #231621, #259025
    + plays files with '+' in its name, LP: #239431, #217305
    + New packages: libvlccore0, libvlccore-dev, vlc-plugin-pulse
     (Closes: #471069)
    + Build-depends on libswsale-dev, libshout3-dev, libxpm-dev,
      zlib1g-dev, liblua5.1-0-dev, libschroedinger-dev, libtag1-dev,
      libqt4-dev, libqt4-dev-tools and pkg-config. (Closes: #461324)
    + time display no longer incomplete, LP: #193445
    + fixed volume bar behavior, LP: #250041
    + shout support closes LP: #127594, #84098,
    + Install new modules:
      - vlc-nox: alphamask, blendbench, bluescreen, canvas, cc, cdg, chain,
        colorthres, croppadd, dynamicoverlay, erase, faad, gaussianblur, grain,
        inhibit, lua, memcpy*, mmap, osd_parser, puzzle, remoteosd, rtmp,
        schroedinger, sharpen, stats, subusf, t140, telepathy, v4l2, vmem
      - vlc: qt4
      - vlc-plugin-jack: access_jack
    + Distribute the .pc for libvlc and vlc-plugin (Closes: #289507)
    + Remove wx interface and glide plugin as they've been dropped by upstream
      LP: #205325, #88487, #90603, #150380
    + The Python and java bindings are no longer part of the upstream tarballs
      (Closes: #469011)
    + Temporarly disable libdca module until a pkg with the new
      API get in unstable
    + Delete or refresh patches
    + New patches:
        - 052_as-needed taken from bug #347650 to teach libtool about
          -Wl,--as-needed
  * Install the skins DTD and the default skins it's only 113kB
  * Improve watch file
  * Add a vlc-data package for /usr/share (13 MB)
  * Add a vlc-dbg package (Closes: #491564)
  * Sort vlc.install and vlc-nox.inst...

Read more...

Changed in vlc:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.