[FFmpeg-cvslog] avformat/mov: Check for string truncation in mov_open_dref()
Michael Niedermayer
git at videolan.org
Sat Mar 21 02:30:17 CET 2015
ffmpeg | branch: release/2.5 | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 14 21:24:54 2015 +0100| [b0cd6fb590810174296e65b362cc1d62a5b63051] | committer: Michael Niedermayer
avformat/mov: Check for string truncation in mov_open_dref()
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b0cd6fb590810174296e65b362cc1d62a5b63051
---
libavformat/mov.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 39f30e4..0160079 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2460,7 +2460,7 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
/* try relative path, we do not try the absolute because it can leak information about our
system to an attacker */
if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
- char filename[1024];
+ char filename[1025];
const char *src_path;
int i, l;
@@ -2490,6 +2490,8 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+ if (strlen(filename) + 1 == sizeof(filename))
+ return AVERROR(ENOENT);
if (!avio_open2(pb, filename, AVIO_FLAG_READ, int_cb, NULL))
return 0;
}
More information about the ffmpeg-cvslog
mailing list