Browse Source

Make sure we dont write more bytes into filename than the array is long.

just a precaution in case the size of the source array is increased or
made dynamically allocateable.

Originally committed as revision 21926 to svn://svn.ffmpeg.org/ffmpeg/trunk
tags/v0.6
Michael Niedermayer 15 years ago
parent
commit
bbdf0d2214
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavformat/mov.c

+ 1
- 1
libavformat/mov.c View File

@@ -1580,7 +1580,7 @@ static int mov_open_dref(ByteIOContext **pb, char *src, MOVDref *ref)
}

/* compose filename if next level down to target was found */
if (i == ref->nlvl_to - 1) {
if (i == ref->nlvl_to - 1 && src_path - src < sizeof(filename)) {
memcpy(filename, src, src_path - src);
filename[src_path - src] = 0;



Loading…
Cancel
Save