[FFmpeg-cvslog] avformat/mov: Check for string truncation in mov_open_dref()

[Michael Niedermayer]

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 14 21:24:54 2015 +0100| [e0975c31f1888d2b1b8ff21ec8c6c56fe1da9cdb] | committer: Michael Niedermayer

avformat/mov: Check for string truncation in mov_open_dref()

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e0975c31f1888d2b1b8ff21ec8c6c56fe1da9cdb
---

 libavformat/mov.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index ab09665..7746cc1 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2366,7 +2366,7 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
     /* try relative path, we do not try the absolute because it can leak information about our
        system to an attacker */
     if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
-        char filename[1024];
+        char filename[1025];
         const char *src_path;
         int i, l;
 
@@ -2396,6 +2396,8 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
 
             av_strlcat(filename, ref->path + l + 1, sizeof(filename));
 
+            if (strlen(filename) + 1 == sizeof(filename))
+                return AVERROR(ENOENT);
             if (!avio_open2(pb, filename, AVIO_FLAG_READ, int_cb, NULL))
                 return 0;
         }