This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit 841484fad5d1d307f1f0f49b07939d5c1292c510 Author: Michael Niedermayer <[email protected]> AuthorDate: Tue May 19 22:05:29 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Jun 13 17:17:16 2026 +0200 avformat/ftp: Check for Telnet IAC characters and other non printable ASCII chars Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 090838497ccecb017e8ffd304dcef4b3ca929fa6) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/ftp.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/libavformat/ftp.c b/libavformat/ftp.c index 4ec864c420..33a7c2ef27 100644 --- a/libavformat/ftp.c +++ b/libavformat/ftp.c @@ -98,6 +98,16 @@ static const AVClass ftp_context_class = { static int ftp_close(URLContext *h); +static int is_bad_string(const unsigned char *s) +{ + while(*s) { + if (*s < 0x20 || *s == 0x7F || *s == 0xFF) + return 1; + s++; + } + return 0; +} + static int ftp_getc(FTPContext *s) { int len; @@ -248,7 +258,7 @@ static int ftp_auth(FTPContext *s) static const int user_codes[] = {331, 230, 0}; static const int pass_codes[] = {230, 0}; - if (strpbrk(s->user, "\r\n")) + if (is_bad_string(s->user)) return AVERROR(EINVAL); err = snprintf(buf, sizeof(buf), "USER %s\r\n", s->user); if (err >= sizeof(buf)) @@ -257,7 +267,7 @@ static int ftp_auth(FTPContext *s) err = ftp_send_command(s, buf, user_codes, NULL); if (err == 331) { if (s->password) { - if (strpbrk(s->password, "\r\n")) + if (is_bad_string(s->password)) return AVERROR(EINVAL); err = snprintf(buf, sizeof(buf), "PASS %s\r\n", s->password); if (err >= sizeof(buf)) @@ -744,8 +754,8 @@ static int ftp_connect(URLContext *h, const char *url) av_free(s->path); s->path = newpath; - if (strpbrk(s->path, "\r\n")) { - av_log(h, AV_LOG_ERROR, "Path contains CR/LF characters\n"); + if (is_bad_string(s->path)) { + av_log(h, AV_LOG_ERROR, "Path contains non-printable characters\n"); return AVERROR(EINVAL); } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
