[FFmpeg-cvslog] avformat/mov: Disallow ".." in dref unless use_absolute_path is set

[Michael Niedermayer]

ffmpeg | branch: release/2.2 | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 14 21:32:35 2015 +0100| [0bcb669eccba63433f5e7fa0a2ca4b7bddab15ef] | committer: Michael Niedermayer

avformat/mov: Disallow ".." in dref unless use_absolute_path is set

as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0bcb669eccba63433f5e7fa0a2ca4b7bddab15ef
---

 libavformat/mov.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 1243c35..5b4986c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2345,6 +2345,9 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
                 av_strlcat(filename, "../", sizeof(filename));
 
             av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+            if (!use_absolute_path)
+                if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
+                    return AVERROR(ENOENT);
 
             if (strlen(filename) + 1 == sizeof(filename))
                 return AVERROR(ENOENT);