aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-03-14 21:24:54 +0100
committerMichael Niedermayer <michaelni@gmx.at>2015-03-14 21:59:47 +0100
commit37469af29454a78227326bf64608b86cb6cd678b (patch)
tree986120a78bf06266b125b5c3d0904b087b776770
parent350054e8e216e7f2370e0215a0222020703e8062 (diff)
downloadffmpeg-37469af29454a78227326bf64608b86cb6cd678b.tar.gz
avformat/mov: Check for string truncation in mov_open_dref()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/mov.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2129620679..438cffbd34 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2600,7 +2600,7 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
/* try relative path, we do not try the absolute because it can leak information about our
system to an attacker */
if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
- char filename[1024];
+ char filename[1025];
const char *src_path;
int i, l;
@@ -2630,6 +2630,8 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+ if (strlen(filename) + 1 == sizeof(filename))
+ return AVERROR(ENOENT);
if (!avio_open2(pb, filename, AVIO_FLAG_READ, int_cb, NULL))
return 0;
}