Re: [FFmpeg-devel] [PATCH] ffserver: local OOB write with custom program name

2017-01-08 Thread compn
On Fri, 6 Jan 2017 23:33:16 +0100 Tobias Stoeckmann wrote: > +slash = strrchr(my_program_name, '/'); > +memcpy(pathname, my_program_name, slash - my_program_name); > -strcpy(slash, "ffmpeg"); > +strcat(pathname, "ffmpeg"); this replaces a strcpy with a memcpy, is this in

Re: [FFmpeg-devel] [PATCH] ffserver: local OOB write with custom program name

2017-01-07 Thread Michael Niedermayer
On Fri, Jan 06, 2017 at 11:33:16PM +0100, Tobias Stoeckmann wrote: > When the command line for children is created, it is assumed that > my_program_name always ends with "ffserver", which doesn't have to > be true if ffserver is called through a symbolic link. > > In such a case, it could be that

[FFmpeg-devel] [PATCH] ffserver: local OOB write with custom program name

2017-01-07 Thread Tobias Stoeckmann
When the command line for children is created, it is assumed that my_program_name always ends with "ffserver", which doesn't have to be true if ffserver is called through a symbolic link. In such a case, it could be that not enough space for "ffmpeg" is available at the end, leading to a buffer ov