Subtitles occasionally throw NSRangeException from [NSCFString characterAtIndex:] in ParseFontVerticality

[pipian]

Upon viewing certain (possibly corrupt) subtitles (e.g. the SpoonSubs? v1 release of Hidamari Sketch x365 episode 3 near ), Perian crashes QuickTime by giving an alert box remarking about a "[NSCFString characterAtIndex:] Range or index out of bounds" error. At the very least, Perian should probably try to silently drop the subtitles instead of throwing an exception.

Crash log is attached, with critical crashed thread trace also copied below:

Thread 13 Crashed: 0 com.apple.CoreFoundation? 0x9756ae94 _TERMINATING_DUE_TO_UNCAUGHT_EXCEPTION_ + 4 1 libobjc.A.dylib 0x95cfee3b objc_exception_throw + 40 2 com.apple.CoreFoundation? 0x9756adcb +[NSException raise:format:arguments:] + 155 3 com.apple.CoreFoundation? 0x9756ae0a +[NSException raise:format:] + 58 4 com.apple.Foundation 0x92560a03 -[NSCFString characterAtIndex:] + 115 5 org.perian.Perian 0x1589a286 ParseFontVerticality? + 38 6 org.perian.Perian 0x1589d462 -[SubATSUIRenderer spanChangedTag:span:div:param:] + 1506 7 org.perian.Perian 0x158791d2 SubParsePacket? + 2770 8 org.perian.Perian 0x1589e043 -[SubATSUIRenderer renderPacket:inContext:width:height:] + 83 9 org.perian.Perian 0x1589b92e SubRenderPacket? + 62 10 org.perian.Perian 0x15886194 TextSubCodecDrawBand? + 260 11 org.perian.Perian 0x15886084 TextSubCodecComponentDispatch? + 212 12 ...ple.CoreServices?.CarbonCore? 0x969c4935 CallComponentDispatch? + 29 13 ...ickTimeComponents.component 0x94af6897 ImageCodecDrawBand? + 43 14 ...ickTimeComponents.component 0x9449f0ef BaseCodec?_ImageCodecDrawBand_VideoDecodeThread + 35 15 com.apple.QuickTime 0x90110556 VideoDecodeThread? + 118 16 libSystem.B.dylib 0x95b6f155 _pthread_start + 321 17 libSystem.B.dylib 0x95b6f012 thread_start + 34

[pipian]

Complete crash log of event.

[pipian]

Would like to add that the particular CRC32 of the defective file should be E433662E, as described on  AniDB. Furthermore, the crash occurs near 20:05-20:10 within the file.

[pipian]

Viewing in VLC does not crash, and suggests it may have something to do with an accented e in the title "I like to top it off with condensed milk or whipped crème", especially as the è bears a different font in VLC compared to the rest of the characters.

[pipian]

The apparently offending ASS file extracted from the MKV

[pipian]

The ASS file is attached, and the crash may be related to font-switching within the subtitle, as the particular line does, in fact, reference "{\fnChinacat}è{\fn}", where chinacat.ttf is one of the attached font files within the MKV file. Is it possible that the length of the subtitle is not the same length as the string, due to not properly handling the font-change within the same line?

[astrange]

Reformatted:

Thread 13 Crashed:
0   com.apple.CoreFoundation?              0x9756ae94 _TERMINATING_DUE_TO_UNCAUGHT_EXCEPTION_ + 4
1   libobjc.A.dylib                       0x95cfee3b objc_exception_throw + 40
2   com.apple.CoreFoundation?              0x9756adcb +[NSException raise:format:arguments:] + 155
3   com.apple.CoreFoundation?              0x9756ae0a +[NSException raise:format:] + 58
4   com.apple.Foundation                  0x92560a03 -[NSCFString characterAtIndex:] + 115
5   org.perian.Perian                     0x1589a286 ParseFontVerticality? + 38
6   org.perian.Perian                     0x1589d462 -[SubATSUIRenderer spanChangedTag:span:div:param:] + 1506
7   org.perian.Perian                     0x158791d2 SubParsePacket? + 2770
8   org.perian.Perian                     0x1589e043 -[SubATSUIRenderer renderPacket:inContext:width:height:] + 83
9   org.perian.Perian                     0x1589b92e SubRenderPacket? + 62
10  org.perian.Perian                     0x15886194 TextSubCodecDrawBand? + 260
11  org.perian.Perian                     0x15886084 TextSubCodecComponentDispatch? + 212
12  ...ple.CoreServices?.CarbonCore?        0x969c4935 CallComponentDispatch? + 29
13  ...ickTimeComponents.component        0x94af6897 ImageCodecDrawBand? + 43
14  ...ickTimeComponents.component        0x9449f0ef BaseCodec?_ImageCodecDrawBand_VideoDecodeThread + 35
15  com.apple.QuickTime                   0x90110556 VideoDecodeThread + 118
16  libSystem.B.dylib                     0x95b6f155 _pthread_start + 321
17  libSystem.B.dylib                     0x95b6f012 thread_start + 34

[astrange]

ParseFontVerticality? assume that \fn contains a font name. I guess "" means the default one? That seems undocumented, but it obviously shouldn't crash anyway.

[pipian]

Behavior in VLC seems to assume that "" is default. Haven't tested with VSFilter on Windows yet.

[astrange]

(In [1250]) Audit for crashes resulting from invalid characterAtIndex: calls.

Briefly tested, refs #473

[astrange]

(In [1278]) SSA: Skip \fn with blank font name.

Fixes #473