Skip to content

Commit 35ab447

Browse files
committed
fix some overflows due to strcpy
fixes #1184, #1186, #1187 among other things
1 parent b3353c2 commit 35ab447

File tree

4 files changed

+58
-6
lines changed

4 files changed

+58
-6
lines changed

Diff for: applications/mp4box/fileimport.c

+20
Original file line numberDiff line numberDiff line change
@@ -2356,24 +2356,44 @@ GF_Err cat_multiple_files(GF_ISOFile *dest, char *fileName, u32 import_flags, Do
23562356
cat_enum.align_timelines = align_timelines;
23572357
cat_enum.allow_add_in_command = allow_add_in_command;
23582358

2359+
if (strlen(fileName) >= sizeof(cat_enum.szPath)) {
2360+
GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("File name %s is too long.\n", fileName));
2361+
return GF_NOT_SUPPORTED;
2362+
}
23592363
strcpy(cat_enum.szPath, fileName);
23602364
sep = strrchr(cat_enum.szPath, GF_PATH_SEPARATOR);
23612365
if (!sep) sep = strrchr(cat_enum.szPath, '/');
23622366
if (!sep) {
23632367
strcpy(cat_enum.szPath, ".");
2368+
if (strlen(fileName) >= sizeof(cat_enum.szRad1)) {
2369+
GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("File name %s is too long.\n", fileName));
2370+
return GF_NOT_SUPPORTED;
2371+
}
23642372
strcpy(cat_enum.szRad1, fileName);
23652373
} else {
2374+
if (strlen(sep + 1) >= sizeof(cat_enum.szRad1)) {
2375+
GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("File name %s is too long.\n", (sep + 1)));
2376+
return GF_NOT_SUPPORTED;
2377+
}
23662378
strcpy(cat_enum.szRad1, sep+1);
23672379
sep[0] = 0;
23682380
}
23692381
sep = strchr(cat_enum.szRad1, '*');
2382+
if (strlen(sep + 1) >= sizeof(cat_enum.szRad2)) {
2383+
GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("File name %s is too long.\n", (sep + 1)));
2384+
return GF_NOT_SUPPORTED;
2385+
}
23702386
strcpy(cat_enum.szRad2, sep+1);
23712387
sep[0] = 0;
23722388
sep = strchr(cat_enum.szRad2, '%');
23732389
if (!sep) sep = strchr(cat_enum.szRad2, '#');
23742390
if (!sep) sep = strchr(cat_enum.szRad2, ':');
23752391
strcpy(cat_enum.szOpt, "");
23762392
if (sep) {
2393+
if (strlen(sep) >= sizeof(cat_enum.szOpt)) {
2394+
GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Invalid option: %s.\n", sep));
2395+
return GF_NOT_SUPPORTED;
2396+
}
23772397
strcpy(cat_enum.szOpt, sep);
23782398
sep[0] = 0;
23792399
}

Diff for: applications/mp4client/main.c

+29-4
Original file line numberDiff line numberDiff line change
@@ -910,7 +910,8 @@ Bool GPAC_EventProc(void *ptr, GF_Event *evt)
910910
break;
911911
case GF_EVENT_NAVIGATE:
912912
if (gf_term_is_supported_url(term, evt->navigate.to_url, 1, no_mime_check)) {
913-
strcpy(the_url, evt->navigate.to_url);
913+
strncpy(the_url, evt->navigate.to_url, sizeof(the_url)-1);
914+
the_url[sizeof(the_url) - 1] = 0;
914915
fprintf(stderr, "Navigating to URL %s\n", the_url);
915916
gf_term_navigate_to(term, evt->navigate.to_url);
916917
return 1;
@@ -1099,6 +1100,11 @@ void set_cfg_option(char *opt_string)
10991100
}
11001101
{
11011102
const size_t sepIdx = sep - opt_string;
1103+
if (sepIdx >= sizeof(szSec)) {
1104+
fprintf(stderr, "Badly formatted option %s - Section name is too long\n", opt_string);
1105+
return;
1106+
}
1107+
11021108
strncpy(szSec, opt_string, sepIdx);
11031109
szSec[sepIdx] = 0;
11041110
}
@@ -1110,8 +1116,16 @@ void set_cfg_option(char *opt_string)
11101116
}
11111117
{
11121118
const size_t sepIdx = sep2 - sep;
1119+
if (sepIdx >= sizeof(szKey)) {
1120+
fprintf(stderr, "Badly formatted option %s - key name is too long\n", opt_string);
1121+
return;
1122+
}
11131123
strncpy(szKey, sep, sepIdx);
11141124
szKey[sepIdx] = 0;
1125+
if (strlen(sep2 + 1) >= sizeof(szVal)) {
1126+
fprintf(stderr, "Badly formatted option %s - value is too long\n", opt_string);
1127+
return;
1128+
}
11151129
strcpy(szVal, sep2+1);
11161130
}
11171131

@@ -1680,7 +1694,14 @@ int mp4client_main(int argc, char **argv)
16801694
else if (!gui_mode && url_arg) {
16811695
char *ext;
16821696

1683-
strcpy(the_url, url_arg);
1697+
if (strlen(url_arg) >= sizeof(the_url)) {
1698+
fprintf(stderr, "Input url %s is too long, truncating to %d chars.\n", url_arg, (int)(sizeof(the_url) - 1));
1699+
strncpy(the_url, url_arg, sizeof(the_url)-1);
1700+
the_url[sizeof(the_url) - 1] = 0;
1701+
}
1702+
else {
1703+
strcpy(the_url, url_arg);
1704+
}
16841705
ext = strrchr(the_url, '.');
16851706
if (ext && (!stricmp(ext, ".m3u") || !stricmp(ext, ".pls"))) {
16861707
GF_Err e = GF_OK;
@@ -1692,7 +1713,10 @@ int mp4client_main(int argc, char **argv)
16921713
GF_DownloadSession *sess = gf_dm_sess_new(term->downloader, the_url, GF_NETIO_SESSION_NOT_THREADED, NULL, NULL, &e);
16931714
if (sess) {
16941715
e = gf_dm_sess_process(sess);
1695-
if (!e) strcpy(the_url, gf_dm_sess_get_cache_name(sess));
1716+
if (!e) {
1717+
strncpy(the_url, gf_dm_sess_get_cache_name(sess), sizeof(the_url) - 1);
1718+
the_url[sizeof(the_cfg) - 1] = 0;
1719+
}
16961720
gf_dm_sess_del(sess);
16971721
}
16981722
}
@@ -1715,7 +1739,8 @@ int mp4client_main(int argc, char **argv)
17151739
fprintf(stderr, "Hit 'h' for help\n\n");
17161740
str = gf_cfg_get_key(cfg_file, "General", "StartupFile");
17171741
if (str) {
1718-
strcpy(the_url, "MP4Client "GPAC_FULL_VERSION);
1742+
strncpy(the_url, "MP4Client "GPAC_FULL_VERSION , sizeof(the_url)-1);
1743+
the_url[sizeof(the_url) - 1] = 0;
17191744
gf_term_connect(term, str);
17201745
startup_file = 1;
17211746
is_connected = 1;

Diff for: modules/ffmpeg_in/ffmpeg_demux.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ static Bool FFD_CanHandleURL(GF_InputService *plug, const char *url)
227227
AVFormatContext *ctx;
228228
AVOutputFormat *fmt_out;
229229
Bool ret = GF_FALSE;
230-
char *ext, szName[1000], szExt[20];
230+
char *ext, szName[1024], szExt[20];
231231
const char *szExtList;
232232
FFDemux *ffd;
233233
if (!plug || !url)
@@ -243,6 +243,9 @@ static Bool FFD_CanHandleURL(GF_InputService *plug, const char *url)
243243

244244
ffd = (FFDemux*)plug->priv;
245245

246+
if (strlen(url) >= sizeof(szName))
247+
return GF_FALSE;
248+
246249
strcpy(szName, url);
247250
ext = strrchr(szName, '#');
248251
if (ext) ext[0] = 0;
@@ -252,7 +255,7 @@ static Bool FFD_CanHandleURL(GF_InputService *plug, const char *url)
252255
ext = strrchr(szName, '.');
253256
if (ext && strlen(ext) > 19) ext = NULL;
254257

255-
if (ext && strlen(ext) > 1) {
258+
if (ext && strlen(ext) > 1 && strlen(ext) <= sizeof(szExt)) {
256259
strcpy(szExt, &ext[1]);
257260
strlwr(szExt);
258261
#ifndef FFMPEG_DEMUX_ENABLE_MPEG2TS

Diff for: src/scene_manager/scene_manager.c

+4
Original file line numberDiff line numberDiff line change
@@ -646,6 +646,10 @@ GF_Err gf_sm_load_init(GF_SceneLoader *load)
646646
ext[0] = '.';
647647
ext = anext;
648648
}
649+
if (strlen(ext) < 2 || strlen(ext) > sizeof(szExt)) {
650+
GF_LOG(GF_LOG_ERROR, GF_LOG_SCENE, ("[Scene Manager] invalid extension in file name %s\n", load->fileName));
651+
return GF_NOT_SUPPORTED;
652+
}
649653
strcpy(szExt, &ext[1]);
650654
strlwr(szExt);
651655
if (strstr(szExt, "bt")) load->type = GF_SM_LOAD_BT;

0 commit comments

Comments
 (0)