demux_subreader.c contains the old MPlayer subtitle parser, and I have absolutely no confidence in this (very crappy) code. There might be one or two security risks associated with running that code on arbitrary input.