Escape entities just before Pango rendering (#2382).

[dcpomatic.git] / src / lib / render_text.cc

diff --git a/src/lib/render_text.cc b/src/lib/render_text.cc
index d3db4ac1940c245987d16c4f055e632d82f2cec7..2338bde97abe449adf0170bcccb79014181f3565 100644 (file)
--- a/src/lib/render_text.cc
+++ b/src/lib/render_text.cc
@@ -103,6 +103,11 @@ marked_up (list<StringText> subtitles, int target_height, float fade_factor, str
                        span += " " + extra_attribute;
                }
                span += ">";
+
+               boost::algorithm::replace_all(text, "&", "&amp;");
+               boost::algorithm::replace_all(text, "<", "&lt;");
+               boost::algorithm::replace_all(text, ">", "&gt;");
+
                span += text;
                span += "</span>";
                return span;