// Adapted semantic slice of gst/subparse/samiparse.c parse_lrc from // GStreamer revision a8f8bbef99e28bbf62aeaa774814b5c3a665e9d6. #include char parsePayload(char* line) { char* start = std::strchr(line, ']'); // The upstream vulnerable path used start in pointer arithmetic and start + 1. return start[1]; } int main() { char line[] = "missing close bracket"; return parsePayload(line); }