Skip to content

security: fix command injection and buffer overflow vulnerabilities #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: master
Choose a base branch
from
Open

security: fix command injection and buffer overflow vulnerabilities #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions ffserver.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -510,7 +510,7 @@ static void start_children(FFServerStream *feed)
}
/* use "ffmpeg" in the path of current program. Ignore user provided path */

strcat(pathname, "ffmpeg");
av_strlcat(pathname, "ffmpeg", slash ? (slash - my_program_name + sizeof("ffmpeg")) : sizeof("ffmpeg"));

for (; feed; feed = feed->next) {

Expand Down Expand Up @@ -1501,7 +1501,7 @@ static int http_parse_request(HTTPContext *c)
redir_type = REDIR_ASF;
} else if (av_match_ext(filename, "rpm,ram")) {
redir_type = REDIR_RAM;
strcpy(filename + strlen(filename)-2, "m");
av_strlcpy(filename + strlen(filename)-2, "m", 3);
} else if (av_match_ext(filename, "rtsp")) {
redir_type = REDIR_RTSP;
compute_real_filename(filename, sizeof(filename) - 1);
Expand Down Expand Up @@ -1997,9 +1997,9 @@ static void compute_status(HTTPContext *c)
eosf = sfilename + strlen(sfilename);
if (eosf - sfilename >= 4) {
if (strcmp(eosf - 4, ".asf") == 0)
strcpy(eosf - 4, ".asx");
av_strlcpy(eosf - 4, ".asx", 5);
else if (strcmp(eosf - 3, ".rm") == 0)
strcpy(eosf - 3, ".ram");
av_strlcpy(eosf - 3, ".ram", 5);
else if (stream->fmt && !strcmp(stream->fmt->name, "rtp")) {
/* generate a sample RTSP director if
* unicast. Generate an SDP redirector if
Expand All @@ -2008,9 +2008,9 @@ static void compute_status(HTTPContext *c)
if (!eosf)
eosf = sfilename + strlen(sfilename);
if (stream->is_multicast)
strcpy(eosf, ".sdp");
av_strlcpy(eosf, ".sdp", sizeof(sfilename) - (eosf - sfilename));
else
strcpy(eosf, ".rtsp");
av_strlcpy(eosf, ".rtsp", sizeof(sfilename) - (eosf - sfilename));
}
}

Expand Down Expand Up @@ -2198,7 +2198,7 @@ static int open_input_stream(HTTPContext *c, const char *info)

/* find file name */
if (c->stream->feed) {
strcpy(input_filename, c->stream->feed->feed_filename);
av_strlcpy(input_filename, c->stream->feed->feed_filename, sizeof(input_filename));
buf_size = FFM_PACKET_SIZE;
/* compute position (absolute time) */
if (av_find_info_tag(buf, sizeof(buf), "date", info)) {
Expand All @@ -2212,7 +2212,7 @@ static int open_input_stream(HTTPContext *c, const char *info)
} else
stream_pos = av_gettime() - c->stream->prebuffer * (int64_t)1000;
} else {
strcpy(input_filename, c->stream->feed_filename);
av_strlcpy(input_filename, c->stream->feed_filename, sizeof(input_filename));
buf_size = 0;
/* compute position (relative time) */
if (av_find_info_tag(buf, sizeof(buf), "date", info)) {
Expand Down
Loading