avformat/mov: Disallow ".." in dref unless use_absolute_path is set
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 14 Mar 2015 20:32:35 +0000 (21:32 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 16 Mar 2015 03:01:58 +0000 (04:01 +0100)
as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/mov.c

index 438cffb..de4004f 100644 (file)
@@ -2629,6 +2629,9 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
                 av_strlcat(filename, "../", sizeof(filename));
 
             av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+            if (!use_absolute_path)
+                if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
+                    return AVERROR(ENOENT);
 
             if (strlen(filename) + 1 == sizeof(filename))
                 return AVERROR(ENOENT);