[FFmpeg-devel] [PATCH v2 1/2] avformat/url: check double dot is not to parent directory

Steven Liu lq at chinaffmpeg.org
Sat Jul 25 05:45:36 EEST 2020


fix ticket: 8814
if get ".." in the url, check next byte and lead byte by double dot,
it there have no '/' and not root node, it is not used go to directory ".."

Signed-off-by: Steven Liu <lq at chinaffmpeg.org>
---
 libavformat/url.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/libavformat/url.c b/libavformat/url.c
index 20463a6674..35f27fe3ca 100644
--- a/libavformat/url.c
+++ b/libavformat/url.c
@@ -97,6 +97,18 @@ static void trim_double_dot_url(char *buf, const char *rel, int size)
     /* set new current position if the root node is changed */
     p = root;
     while (p && (node = strstr(p, ".."))) {
+        if (strlen(node) > 2 && node[2] != '/') {
+            node = strstr(node + 1, "..");
+            if (!node)
+                break;
+        }
+
+        if (p != node && p[node - p - 1] != '/') {
+            node = strstr(node + 1, "..");
+            if (!node)
+                break;
+        }
+
         av_strlcat(tmp_path, p, node - p + strlen(tmp_path));
         p = node + 3;
         sep = strrchr(tmp_path, '/');
-- 
2.25.0






More information about the ffmpeg-devel mailing list