diff options
| author | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2008-02-27 09:30:05 +0000 |
|---|---|---|
| committer | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2008-02-27 09:30:05 +0000 |
| commit | dbb7cbf26ed44d258c56e976de3300d87b716875 (patch) | |
| tree | 7f6d29563660d65a69fdf0910107b9dea8b8c431 | |
| parent | a6601d69bb83613f3cede7309f7cb19abf3ab34b (diff) | |
| download | ffmpeg-dbb7cbf26ed44d258c56e976de3300d87b716875.tar.gz | |
fix possible overflow with memmove
Originally committed as revision 12261 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 71ddc6ab26..75746bd410 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -256,7 +256,7 @@ static int mov_read_dref(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom) if (type == 2) { // absolute path dref->path = av_mallocz(len+1); get_buffer(pb, dref->path, len); - if (!strncmp(dref->path, volume, volume_len)) { + if (len > volume_len && !strncmp(dref->path, volume, volume_len)) { len -= volume_len; memmove(dref->path, dref->path+volume_len, len); dref->path[len] = 0; |