[MPlayer-dev-eng] [PATCH] mencoder to load win32 codecs properly

[Sascha Sommer]

On Friday 14 October 2005 08:35, Zuxy wrote:
> 2005/10/13, Sascha Sommer <saschasommer at freenet.de>:
> > On Thursday 13 October 2005 14:51, Reimar Döffinger wrote:
> >
> > Yes, it is what the current code does, but I think it will also try to
> > load the dll from windows/system32 first, ignoring $PATH. I only thought
> > that it might be usefull to add additional paths without having to
> > recompile MPlayer.
>
> To do that I think the best way is to add an mplayer option instead of
> relying on $PATH.

I don't know. $PATH is $PATH. When it doesn't contain the entries it contained 
when you started MPlayer there might also be a problem when you start 
external programs from within MPlayer like the osdmenu does or other 
functions that rely on $PATH. Completely ignoring $PATH is not something I'd 
expect from an app. It is not that much of an issue, though.
So if you say that statement is crap we can as well leave it out.

The best would be to call LoadLibrary with the full path anyway. The only 
difficulty there is that dlls, that rely on other dlls in the same dir, won't 
be able to find these dlls.

>
> And to Sascha, I'm not quite familiar for the security implication of
> string operations. What I do is just to move the code from mplayer.c
> to get_path.c, replace the hardcoded filename and add some message
> outputs, which may need further modification as you suggested. So may
> I say the patch is at least as secure as the original code? And since
> WIN32_PATH is a compile-time constant I don't think it'll be utilized
> to cause a buffer overflow at runtime by a hacker. Anyway, if we added
> the option mentioned above we should take further consideration.
>

The current patch should be save when the compile time constants are sane.

> So, I'd better resend the patch or you would edit it yourself? Thanks.
>

I think I'll commit the patch as is (without some of the mp_msgs). If it is 
wanted the other issue can still be changed later.

Regards

Sascha