diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2015-03-14 21:24:54 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-14 21:59:49 +0100 |
commit | bf0d2ee92c33d802907e829f99c26a46578ed679 (patch) | |
tree | 958428689ef18f36ae01dd646d52e1f3338e47d1 | |
parent | 53239e50ed366f9c12ef7531e63c5c0693fed328 (diff) | |
download | ffmpeg-n2.2.14.tar.gz |
avformat/mov: Check for string truncation in mov_open_dref()n2.2.14
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index d0d28bd081..1243c354d6 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2316,7 +2316,7 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref, /* try relative path, we do not try the absolute because it can leak information about our system to an attacker */ if (ref->nlvl_to > 0 && ref->nlvl_from > 0) { - char filename[1024]; + char filename[1025]; const char *src_path; int i, l; @@ -2346,6 +2346,8 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref, av_strlcat(filename, ref->path + l + 1, sizeof(filename)); + if (strlen(filename) + 1 == sizeof(filename)) + return AVERROR(ENOENT); if (!avio_open2(pb, filename, AVIO_FLAG_READ, int_cb, NULL)) return 0; } |