Signed-off-by: Cai Fan <[email protected]>--- libavformat/img2enc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c
index 41638d92b8..a1eb0c688d 100644
--- a/libavformat/img2enc.c
+++ b/libavformat/img2enc.c
@@ -180,7 +180,12 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
}
for (i = 0; i < 4; i++) {
av_dict_copy(&options, img->protocol_opts, 0);
- snprintf(img->temp[i], sizeof(img->tmp[i]), "%s.tmp", filename);
+ int len = snprintf(img->tmp[i], sizeof(img->tmp[i]), "%s.tmp",
filename);
+ if (len < 0 || len >= sizeof(img->tmp[i])) {
+ av_log(s, AV_LOG_ERROR, "filename '%s' exceeds buffer size %zu\n",
filename, sizeof(img->tmp[i]));
+ ret = AVERROR(EINVAL);
+ goto fail;
+ }
av_strlcpy(img->target[i], filename, sizeof(img->target[i]));
if (s->io_open(s, &pb[i], img->use_rename ? img->tmp[i] : filename,
AVIO_FLAG_WRITE, &options) < 0) {
av_log(s, AV_LOG_ERROR, "Could not open file : %s\n",
img->use_rename ? img->tmp[i] : filename);
--
> On Jul 31, 2025, at 10:13, Cai Fan <[email protected]> wrote:
>
> Signed-off-by: Cai Fan <[email protected]>
> ---
> libavformat/img2enc.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c
> index 41638d92b8..a1eb0c688d 100644
> --- a/libavformat/img2enc.c
> +++ b/libavformat/img2enc.c
> @@ -180,7 +180,12 @@ static int write_packet(AVFormatContext *s, AVPacket
> *pkt)
> }
> for (i = 0; i < 4; i++) {
> av_dict_copy(&options, img->protocol_opts, 0);
> - snprintf(img->tmp[i], sizeof(img->tmp[i]), "%s.tmp", filename);
> + int len = snprintf(img->tmp[i], sizeof(img->tmp[i]), "%s.tmp",
> filename);
> + if (len < 0 || len >= sizeof(img->tmp[i])) {
> + av_log(s, AV_LOG_ERROR, "Filename too long: %s\n", filename);
“filename exceeds buffer size %zu\n”.
> + ret = AVERROR(EINVAL);
> + goto fail;
> + }
> av_strlcpy(img->target[i], filename, sizeof(img->target[i]));
> if (s->io_open(s, &pb[i], img->use_rename ? img->tmp[i] : filename,
> AVIO_FLAG_WRITE, &options) < 0) {
> av_log(s, AV_LOG_ERROR, "Could not open file : %s\n",
> img->use_rename ? img->tmp[i] : filename);
> --
> 2.34.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> [email protected]
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> [email protected] with subject "unsubscribe".
0001-libavformat-img2enc.c-rm-warning-.tmp-directive-outp.patch
Description: Binary data
_______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
