rtmpproto: Check the buffer sizes when copying app/playpath strings
authorMartin Storsjö <martin@martin.st>
Thu, 8 May 2014 12:12:23 +0000 (15:12 +0300)
committerReinhard Tartler <siretart@tauware.de>
Fri, 9 May 2014 00:00:47 +0000 (20:00 -0400)
As pointed out by Reimar Döffinger.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0bacfa8d37710b904897e7cbeb8d6f96fbf75e2e)

Conflicts:
libavformat/rtmpproto.c

libavformat/rtmpproto.c

index bc6a4fe..ead5ccd 100644 (file)
@@ -2483,10 +2483,10 @@ reconnect:
             fname = strchr(p + 1, '/');
             if (!fname || (c && c < fname)) {
                 fname = p + 1;
-                av_strlcpy(rt->app, path + 1, p - path);
+                av_strlcpy(rt->app, path + 1, FFMIN(p - path, APP_MAX_LENGTH));
             } else {
                 fname++;
-                av_strlcpy(rt->app, path + 1, fname - path - 1);
+                av_strlcpy(rt->app, path + 1, FFMIN(fname - path - 1, APP_MAX_LENGTH));
             }
         }
     }