Message ID | 1428411966-24973-2-git-send-email-vittorio.giovara@gmail.com |
---|---|
State | Committed |
Commit | 9286de045968ad456d4e752651eec22de5e89060 |
Headers | show |
s/does is/is/ Diego
On Tue, Apr 07, 2015 at 03:06:05PM +0200, Vittorio Giovara wrote: > --- a/libavformat/mov.c > +++ b/libavformat/mov.c > @@ -2300,7 +2300,7 @@ static int mov_open_dref(AVIOContext **pb, char *src, MOVDref *ref, > /* try relative path, we do not try the absolute because it can leak information about our > system to an attacker */ > - if (ref->nlvl_to > 0 && ref->nlvl_from > 0) { > + if (ref->nlvl_to > 0 && ref->nlvl_from > 0 && ref->path[0] != '/') { Won't this work only on Unix? Diego
On Fri, Apr 10, 2015 at 10:25 PM, Diego Biurrun <diego@biurrun.de> wrote: > On Tue, Apr 07, 2015 at 03:06:05PM +0200, Vittorio Giovara wrote: >> --- a/libavformat/mov.c >> +++ b/libavformat/mov.c >> @@ -2300,7 +2300,7 @@ static int mov_open_dref(AVIOContext **pb, char *src, MOVDref *ref, >> /* try relative path, we do not try the absolute because it can leak information about our >> system to an attacker */ >> - if (ref->nlvl_to > 0 && ref->nlvl_from > 0) { >> + if (ref->nlvl_to > 0 && ref->nlvl_from > 0 && ref->path[0] != '/') { > > Won't this work only on Unix? > > Diego Afaik only UNIX style paths are stored in this atom.
On Sun, Apr 12, 2015 at 5:48 PM, Vittorio Giovara <vittorio.giovara@gmail.com> wrote: > On Fri, Apr 10, 2015 at 10:25 PM, Diego Biurrun <diego@biurrun.de> wrote: >> On Tue, Apr 07, 2015 at 03:06:05PM +0200, Vittorio Giovara wrote: >>> --- a/libavformat/mov.c >>> +++ b/libavformat/mov.c >>> @@ -2300,7 +2300,7 @@ static int mov_open_dref(AVIOContext **pb, char *src, MOVDref *ref, >>> /* try relative path, we do not try the absolute because it can leak information about our >>> system to an attacker */ >>> - if (ref->nlvl_to > 0 && ref->nlvl_from > 0) { >>> + if (ref->nlvl_to > 0 && ref->nlvl_from > 0 && ref->path[0] != '/') { >> >> Won't this work only on Unix? >> >> Diego > > Afaik only UNIX style paths are stored in this atom. Let me rephrase, in this atom, when type == 2 paths are stored MacOS style, so with : instead of /, and we take care of the : to / conversion, when type == 18 paths are stored in UNIX style, so we just copy the path there. In one way or another an absolute path will always start with / to my knowledge. This section in the spec is very poorly documented.
diff --git a/libavformat/mov.c b/libavformat/mov.c index 5f577f3..f35f06d 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2300,7 +2300,7 @@ static int mov_open_dref(AVIOContext **pb, char *src, MOVDref *ref, { /* try relative path, we do not try the absolute because it can leak information about our system to an attacker */ - if (ref->nlvl_to > 0 && ref->nlvl_from > 0) { + if (ref->nlvl_to > 0 && ref->nlvl_from > 0 && ref->path[0] != '/') { char filename[1024]; char *src_path; int i, l;