Browse Source

avformat/mov: Disallow ".." in dref unless use_absolute_path is set

as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e4d0498df)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.4.8
Michael Niedermayer 11 years ago
parent
commit
17e6d249b7
1 changed files with 3 additions and 0 deletions
  1. +3
    -0
      libavformat/mov.c

+ 3
- 0
libavformat/mov.c View File

@@ -2395,6 +2395,9 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
av_strlcat(filename, "../", sizeof(filename));

av_strlcat(filename, ref->path + l + 1, sizeof(filename));
if (!use_absolute_path)
if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
return AVERROR(ENOENT);

if (strlen(filename) + 1 == sizeof(filename))
return AVERROR(ENOENT);


Loading…
Cancel
Save