diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-23 16:58:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-03 03:04:11 +0100 |
| commit | d034ddcd1f6cdd5528f02db38cf3552301bef1a4 (patch) | |
| tree | 635f5786ce99075168f48a48556d372c1da36e89 | |
| parent | 676df8c4c70c67f8f31a439f8ab301f7de3fe977 (diff) | |
| download | ffmpeg-d034ddcd1f6cdd5528f02db38cf3552301bef1a4.tar.gz | |
rtmpproto: Check APP_MAX_LENGTH
Fixes Ticket2292
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 02ac3398eb52679301028c2fd3ebad1b6261b4da)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/rtmpproto.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index e23dd2db41..090d8ec5bb 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2156,16 +2156,20 @@ static int rtmp_open(URLContext *s, const char *uri, int flags) fname = strchr(p + 1, '/'); if (!fname || (c && c < fname)) { fname = p + 1; - av_strlcpy(rt->app, path + 1, p - path); + av_strlcpy(rt->app, path + 1, FFMIN(p - path, APP_MAX_LENGTH)); } else { fname++; - av_strlcpy(rt->app, path + 1, fname - path - 1); + av_strlcpy(rt->app, path + 1, FFMIN(fname - path - 1, APP_MAX_LENGTH)); } } } if (old_app) { // The name of application has been defined by the user, override it. + if (strlen(old_app) >= APP_MAX_LENGTH) { + ret = AVERROR(EINVAL); + goto fail; + } av_free(rt->app); rt->app = old_app; } |