image_writer: fix TOCTOU in screenshot filename generation

The screenshot command is documented to not overwrite existing files.
However, there is a race window between the filename is generated with
gen_fname and when the file is open to write. Specifically, the
convert_image function in this window can be very time consuming
depending on video and screenshot image format and size. This results
in existing file being overwritten because the file writing functions
don't check for the existance of file.

Fix this be opening the file in exclusive mode. Add overwrite parameter to
write_image for other operations that are documented to overwrite existing
files, like screenshot-to-file. Note that for write_avif, checking
existance is used instead because avio_open does not support exclusive
open mode.

1 files changed, 1 insertions, 1 deletions

diff --git a/video/image_writer.h b/video/image_writer.h
index 72d160269b..c22606ed65 100644
--- a/video/image_writer.h
+++ b/video/image_writer.h
@@ -68,7 +68,7 @@ int image_writer_format_from_ext(const char *ext);
  */
 bool write_image(struct mp_image *image, const struct image_writer_opts *opts,
                 const char *filename, struct mpv_global *global,
-                 struct mp_log *log);
+                 struct mp_log *log, bool overwrite);
 
 // Debugging helper.
 void dump_png(struct mp_image *image, const char *filename, struct mp_log *log);