Not intended to be run on urls. Fixes stack-overflow in glob() when unexpected data is passed. Found by OSS-Fuzz.
Unified · Split
| @@ -119,7 +119,11 @@ static mf_t *open_mf_pattern(void *talloc_ctx, struct demuxer *d, char *filename · 118 unmodified lines | ||
| 119 | 119 | goto exit_mf; |
| 120 | 120 | } |
| 121 | 121 | |
| 122 | − size_t fname_avail = strlen(filename) + 32; | |
| 122 | + bstr bfilename = bstr0(filename); | |
| 123 | + if (mp_is_url(bfilename)) | |
| 124 | + goto exit_mf; | |
| 125 | + | |
| 126 | + size_t fname_avail = bfilename.len + 32; | |
| 123 | 127 | char *fname = talloc_size(mf, fname_avail); |
| 124 | 128 | |
| 125 | 129 | #if HAVE_GLOB |