From 46183d4419d77035b61ec9984ac1713d46160ef3 Mon Sep 17 00:00:00 2001
From: Noethix55555 <277300782+Noethix55555@users.noreply.github.com>
Date: Wed, 17 Jun 2026 19:40:40 -0400
Subject: [PATCH] fix(command): avoid command-string injection in show-text and
 out-of-range in cycle-audio

---
 src/MpvNet/Command.cs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/MpvNet/Command.cs b/src/MpvNet/Command.cs
index 206a55d2..db4135db 100644
--- a/src/MpvNet/Command.cs
+++ b/src/MpvNet/Command.cs
@@ -60,8 +60,8 @@ public static void ShowText(string text, int duration = 0, int fontSize = 0)
         if (fontSize == 0)
             fontSize = Player.GetPropertyInt("osd-font-size");
 
-        Player.Command("show-text \"${osd-ass-cc/0}{\\\\fs" + fontSize +
-            "}${osd-ass-cc/1}" + text + "\" " + duration);
+        Player.CommandV("show-text", "${osd-ass-cc/0}{\\fs" + fontSize +
+            "}${osd-ass-cc/1}" + text, duration.ToString());
     }
 
     void CycleAudio()
@@ -88,6 +88,9 @@ void CycleAudio()
                 Player.SetPropertyInt("aid", aid);
             }
 
+            if (aid < 1 || aid > tracks.Length)
+                return;
+
             Player.CommandV("show-text", aid + "/" + tracks.Length + ": " + tracks[aid - 1].Text[3..], "5000");
         }
     }