as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this
Found-by: ramiro
Signed-off-by: Michael Niedermayer <michae...@gmx.at>
---
libavformat/mov.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 438cffb..de4004f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2629,6 +2629,9 @@ static int mov_open_dref(AVIOContext **pb, const char
*src, MOVDref *ref,
av_strlcat(filename, "../", sizeof(filename));
av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+ if (!use_absolute_path)
+ if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
+ return AVERROR(ENOENT);
if (strlen(filename) + 1 == sizeof(filename))
return AVERROR(ENOENT);
--
1.7.9.5
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
