griefith/test2
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix buffer overflow with seq_proxy_get_custom_file_fname

Browse Source 
The file path was 256 bytes, passing in a buffer size of 1792
for string join & making the path absolute could also overflow
as it assumes a size of 1024.
This commit is contained in:
Campbell Barton
2023-05-13 17:34:14 +10:00
parent 7433f34c4d
commit 88938f03c7
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
source/blender/sequencer/intern/proxy.c
View File

@@ -98,7 +98,8 @@ double SEQ_rendersize_to_scale_factor(int render_size)
bool seq_proxy_get_custom_file_fname(Sequence *seq, char *filepath, const int view_id)
{
char filepath_temp[FILE_MAXFILE];
/* Ideally this would be #PROXY_MAXFILE however BLI_path_abs clamps to #FILE_MAX. */
char filepath_temp[FILE_MAX];
char suffix[24];
StripProxy *proxy = seq->strip->proxy;
@@ -106,7 +107,7 @@ bool seq_proxy_get_custom_file_fname(Sequence *seq, char *filepath, const int vi
return false;
}
BLI_path_join(filepath_temp, PROXY_MAXFILE, proxy->dir, proxy->file);
BLI_path_join(filepath_temp, sizeof(filepath_temp), proxy->dir, proxy->file);
BLI_path_abs(filepath_temp, BKE_main_blendfile_path_from_global());
if (view_id > 0) {