[FFmpeg-cvslog] avformat/mov: Disallow ".." in dref unless use_absolute_path is set

Michael Niedermayer git at videolan.org
Mon Mar 16 04:10:18 CET 2015


ffmpeg | branch: release/2.6 | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 14 21:32:35 2015 +0100| [f6327e5fa618d4884a83aea5efb5e72b3bc1d371] | committer: Michael Niedermayer

avformat/mov: Disallow ".." in dref unless use_absolute_path is set

as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f6327e5fa618d4884a83aea5efb5e72b3bc1d371
---

 libavformat/mov.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 438cffb..de4004f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2629,6 +2629,9 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
                 av_strlcat(filename, "../", sizeof(filename));
 
             av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+            if (!use_absolute_path)
+                if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
+                    return AVERROR(ENOENT);
 
             if (strlen(filename) + 1 == sizeof(filename))
                 return AVERROR(ENOENT);



More information about the ffmpeg-cvslog mailing list