[FFmpeg-devel] [PATCH] avformat/mov: Disallow ".." in dref unless use_absolute_path is set

[Michael Niedermayer]

as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
---
 libavformat/mov.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 438cffb..de4004f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2629,6 +2629,9 @@ static int mov_open_dref(AVIOContext **pb, const char *src, MOVDref *ref,
                 av_strlcat(filename, "../", sizeof(filename));
 
             av_strlcat(filename, ref->path + l + 1, sizeof(filename));
+            if (!use_absolute_path)
+                if(strstr(ref->path + l + 1, "..") || ref->nlvl_from > 1)
+                    return AVERROR(ENOENT);
 
             if (strlen(filename) + 1 == sizeof(filename))
                 return AVERROR(ENOENT);
-- 
1.7.9.5