Index: path.c
===================================================================
--- path.c	(revision 36298)
+++ path.c	(working copy)
@@ -26,6 +26,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include "config.h"
 #include "mp_msg.h"
 #include "path.h"
@@ -225,6 +226,8 @@

     if (len == 0)
         return strdup("./");
+    if (len >= PATH_MAX)
+        return NULL;
     dirname = malloc(len + 1);
     if (!dirname)
         return NULL;
@@ -254,11 +257,15 @@
 #else
     if (path[0] == '/')
 #endif
-        return strdup(path);
+        return strlen(path) >= PATH_MAX ? NULL : strdup(path);

     ret = mp_dirname(base);
     if (!ret)
         return NULL;
+    if (strlen(ret) + strlen(path) >= PATH_MAX) {
+        free(ret);
+        return NULL;
+    }
     tmp = realloc(ret, strlen(ret) + strlen(path) + 1);
     if (!tmp) {
         free(ret);