---
libavformat/mov.c | 20 +++++++++++++++++---
1 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index c9acdef..93b24c3 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -378,15 +378,22 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
MOVDref *dref = &sc->drefs[i];
uint32_t size = avio_rb32(pb);
int64_t next = avio_tell(pb) + size - 4;
+ int flags;
if (size < 12)
return AVERROR_INVALIDDATA;
dref->type = avio_rl32(pb);
- avio_rb32(pb); // version + flags
+ avio_r8(pb);
+ flags = avio_rb24(pb);
av_dlog(c->fc, "type %.4s size %d\n", (char*)&dref->type, size);
- if (dref->type == MKTAG('a','l','i','s') && size > 150) {
+ if (dref->type == MKTAG('u','r','l',' ') && flags != 1) {
+ dref->path = av_mallocz(size + 1);
+ if (!dref->path)
+ return AVERROR(ENOMEM);
+ avio_get_str(pb, size, dref->path, size + 1);
+ } else if (dref->type == MKTAG('a','l','i','s') && size > 150) {
/* macintosh alias record */
uint16_t volume_len, len;
int16_t type;
@@ -2110,7 +2117,14 @@ static int mov_open_dref(AVIOContext **pb, char *src,
MOVDref *ref,
{
/* try relative path, we do not try the absolute because it can leak
information about our
system to an attacker */
- if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
+ if (ref->type == MKTAG('u','r','l',' ') && strlen(ref->path) > 0) {
+ if (ref->path[0] != '/' && !strstr(ref->path, "://")) {
+ char filename[1024];
+ ff_make_absolute_url(filename, sizeof(filename), src, ref->path);
+ if (!avio_open2(pb, filename, AVIO_FLAG_READ, int_cb, NULL))
+ return 0;
+ }
+ } else if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
char filename[1024];
char *src_path;
int i, l;
--
1.7.9
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
