From 42b784ac1a0c71e7d494db68ff700101461f840f Mon Sep 17 00:00:00 2001 From: diego Date: Fri, 25 Jun 2004 16:49:53 +0000 Subject: string handling security fixes patch by Nicholas Kain, Alexander Strasser reviewed by Pontscho, Alex, Rich git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@12647 b3059339-0415-0410-9bf9-f77b7e298cf2 --- Gui/mplayer/common.c | 107 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 65 insertions(+), 42 deletions(-) (limited to 'Gui/mplayer') diff --git a/Gui/mplayer/common.c b/Gui/mplayer/common.c index 861227abf1..d206b4d27c 100644 --- a/Gui/mplayer/common.c +++ b/Gui/mplayer/common.c @@ -32,35 +32,39 @@ extern unsigned int GetTimerMS( void ); -inline void TranslateFilename( int c,char * tmp ) +inline void TranslateFilename( int c,char * tmp,size_t tmplen ) { int i; + char * p; + switch ( guiIntfStruct.StreamType ) { case STREAMTYPE_STREAM: - strcpy( tmp,guiIntfStruct.Filename ); + strlcpy(tmp, guiIntfStruct.Filename, tmplen); break; case STREAMTYPE_FILE: if ( ( guiIntfStruct.Filename )&&( guiIntfStruct.Filename[0] ) ) { - if ( strrchr( guiIntfStruct.Filename,'/' ) ) strncpy( tmp,strrchr( guiIntfStruct.Filename,'/' ) + 1, 511 ); - else strncpy( tmp,guiIntfStruct.Filename , 511); + if ( p = strrchr(guiIntfStruct.Filename, '/') ) + strlcpy(tmp, p + 1, tmplen); + else + strlcpy(tmp, guiIntfStruct.Filename, tmplen); if ( tmp[strlen( tmp ) - 4] == '.' ) tmp[strlen( tmp ) - 4]=0; if ( tmp[strlen( tmp ) - 5] == '.' ) tmp[strlen( tmp ) - 5]=0; - } else strcpy( tmp,MSGTR_NoFileLoaded ); + } else strlcpy( tmp,MSGTR_NoFileLoaded,tmplen ); break; #ifdef USE_DVDREAD case STREAMTYPE_DVD: - if ( guiIntfStruct.DVD.current_chapter ) sprintf( tmp,MSGTR_Chapter,guiIntfStruct.DVD.current_chapter ); - else strcat( tmp,MSGTR_NoChapter ); + if ( guiIntfStruct.DVD.current_chapter ) snprintf(tmp,tmplen,MSGTR_Chapter,guiIntfStruct.DVD.current_chapter ); + else strlcat( tmp,MSGTR_NoChapter,tmplen ); break; #endif #ifdef HAVE_VCD case STREAMTYPE_VCD: - sprintf( tmp,MSGTR_VCDTrack,guiIntfStruct.Track ); + snprintf( tmp,tmplen,MSGTR_VCDTrack,guiIntfStruct.Track ); break; #endif - default: strcpy( tmp,MSGTR_NoMediaOpened ); + default: strlcpy( tmp,MSGTR_NoMediaOpened,tmplen ); } if ( c ) { @@ -74,75 +78,94 @@ inline void TranslateFilename( int c,char * tmp ) } } +/* Unsafe! Pass only null-terminated strings as (char *)str. */ char * Translate( char * str ) { static char trbuf[512]; char tmp[512]; int i,c; int t; + int strsize = 0; memset( trbuf,0,512 ); memset( tmp,0,128 ); - for ( c=0,i=0;i < (int)strlen( str );i++ ) + strsize = strlen(str); + for ( c=0,i=0;i < strsize;i++ ) { if ( str[i] != '$' ) { trbuf[c++]=str[i]; trbuf[c]=0; } else { switch ( str[++i] ) { - case 't': sprintf( tmp,"%02d",guiIntfStruct.Track ); strcat( trbuf,tmp ); break; - case 'o': TranslateFilename( 0,tmp ); strcat( trbuf,tmp ); break; - case 'f': TranslateFilename( 1,tmp ); strcat( trbuf,tmp ); break; - case 'F': TranslateFilename( 2,tmp ); strcat( trbuf,tmp ); break; + case 't': snprintf( tmp,sizeof( tmp ),"%02d",guiIntfStruct.Track ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'o': TranslateFilename( 0,tmp,sizeof( tmp ) ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'f': TranslateFilename( 1,tmp,sizeof( tmp ) ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'F': TranslateFilename( 2,tmp,sizeof( tmp ) ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; case '6': t=guiIntfStruct.LengthInSec; goto calclengthhhmmss; case '1': t=guiIntfStruct.TimeSec; calclengthhhmmss: - sprintf( tmp,"%02d:%02d:%02d",t/3600,t/60%60,t%60 ); strcat( trbuf,tmp ); + snprintf( tmp,sizeof( tmp ),"%02d:%02d:%02d",t/3600,t/60%60,t%60 ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; case '7': t=guiIntfStruct.LengthInSec; goto calclengthmmmmss; case '2': t=guiIntfStruct.TimeSec; calclengthmmmmss: - sprintf( tmp,"%04d:%02d",t/60,t%60 ); strcat( trbuf,tmp ); + snprintf( tmp,sizeof( tmp ),"%04d:%02d",t/60,t%60 ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; - case '3': sprintf( tmp,"%02d",guiIntfStruct.TimeSec / 3600 ); strcat( trbuf,tmp ); break; - case '4': sprintf( tmp,"%02d",( ( guiIntfStruct.TimeSec / 60 ) % 60 ) ); strcat( trbuf,tmp ); break; - case '5': sprintf( tmp,"%02d",guiIntfStruct.TimeSec % 60 ); strcat( trbuf,tmp ); break; - case '8': sprintf( tmp,"%01d:%02d:%02d",guiIntfStruct.TimeSec / 3600,( guiIntfStruct.TimeSec / 60 ) % 60,guiIntfStruct.TimeSec % 60 ); strcat( trbuf,tmp ); break; - case 'v': sprintf( tmp,"%3.2f%%",guiIntfStruct.Volume ); strcat( trbuf,tmp ); break; - case 'V': sprintf( tmp,"%3.1f",guiIntfStruct.Volume ); strcat( trbuf,tmp ); break; - case 'b': sprintf( tmp,"%3.2f%%",guiIntfStruct.Balance ); strcat( trbuf,tmp ); break; - case 'B': sprintf( tmp,"%3.1f",guiIntfStruct.Balance ); strcat( trbuf,tmp ); break; - case 'd': sprintf( tmp,"%d",guiIntfStruct.FrameDrop ); strcat( trbuf,tmp ); break; - case 'x': sprintf( tmp,"%d",guiIntfStruct.MovieWidth ); strcat( trbuf,tmp ); break; - case 'y': sprintf( tmp,"%d",guiIntfStruct.MovieHeight ); strcat( trbuf,tmp ); break; - case 'C': sprintf( tmp,"%s", guiIntfStruct.sh_video? ((sh_video_t *)guiIntfStruct.sh_video)->codec->name : ""); - strcat( trbuf,tmp ); break; - case 's': if ( guiIntfStruct.Playing == 0 ) strcat( trbuf,"s" ); break; - case 'l': if ( guiIntfStruct.Playing == 1 ) strcat( trbuf,"p" ); break; - case 'e': if ( guiIntfStruct.Playing == 2 ) strcat( trbuf,"e" ); break; + case '3': snprintf( tmp,sizeof( tmp ),"%02d",guiIntfStruct.TimeSec / 3600 ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case '4': snprintf( tmp,sizeof( tmp ),"%02d",( ( guiIntfStruct.TimeSec / 60 ) % 60 ) ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case '5': snprintf( tmp,sizeof( tmp ),"%02d",guiIntfStruct.TimeSec % 60 ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case '8': snprintf( tmp,sizeof( tmp ),"%01d:%02d:%02d",guiIntfStruct.TimeSec / 3600,( guiIntfStruct.TimeSec / 60 ) % 60,guiIntfStruct.TimeSec % 60 ); strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'v': snprintf( tmp,sizeof( tmp ),"%3.2f%%",guiIntfStruct.Volume ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'V': snprintf( tmp,sizeof( tmp ),"%3.1f",guiIntfStruct.Volume ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'b': snprintf( tmp,sizeof( tmp ),"%3.2f%%",guiIntfStruct.Balance ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'B': snprintf( tmp,sizeof( tmp ),"%3.1f",guiIntfStruct.Balance ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'd': snprintf( tmp,sizeof( tmp ),"%d",guiIntfStruct.FrameDrop ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'x': snprintf( tmp,sizeof( tmp ),"%d",guiIntfStruct.MovieWidth ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'y': snprintf( tmp,sizeof( tmp ),"%d",guiIntfStruct.MovieHeight ); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 'C': snprintf( tmp,sizeof( tmp ),"%s", guiIntfStruct.sh_video? ((sh_video_t *)guiIntfStruct.sh_video)->codec->name : ""); + strlcat( trbuf,tmp,sizeof( trbuf ) ); break; + case 's': if ( guiIntfStruct.Playing == 0 ) strlcat( trbuf,"s",sizeof( trbuf ) ); break; + case 'l': if ( guiIntfStruct.Playing == 1 ) strlcat( trbuf,"p",sizeof( trbuf ) ); break; + case 'e': if ( guiIntfStruct.Playing == 2 ) strlcat( trbuf,"e",sizeof( trbuf ) ); break; case 'a': - if ( muted ) { strcat( trbuf,"n" ); break; } + if ( muted ) { strlcat( trbuf,"n",sizeof( trbuf ) ); break; } switch ( guiIntfStruct.AudioType ) { - case 0: strcat( trbuf,"n" ); break; - case 1: strcat( trbuf,"m" ); break; - case 2: strcat( trbuf,"t" ); break; + case 0: strlcat( trbuf,"n",sizeof( trbuf ) ); break; + case 1: strlcat( trbuf,"m",sizeof( trbuf ) ); break; + case 2: strlcat( trbuf,"t",sizeof( trbuf ) ); break; } break; case 'T': switch ( guiIntfStruct.StreamType ) { - case STREAMTYPE_FILE: strcat( trbuf,"f" ); break; + case STREAMTYPE_FILE: strlcat( trbuf,"f",sizeof( trbuf ) ); break; #ifdef HAVE_VCD - case STREAMTYPE_VCD: strcat( trbuf,"v" ); break; + case STREAMTYPE_VCD: strlcat( trbuf,"v",sizeof( trbuf ) ); break; #endif - case STREAMTYPE_STREAM: strcat( trbuf,"u" ); break; + case STREAMTYPE_STREAM: strlcat( trbuf,"u",sizeof( trbuf ) ); break; #ifdef USE_DVDREAD - case STREAMTYPE_DVD: strcat( trbuf,"d" ); break; + case STREAMTYPE_DVD: strlcat( trbuf,"d",sizeof( trbuf ) ); break; #endif - default: strcat( trbuf," " ); break; + default: strlcat( trbuf," ",sizeof( trbuf ) ); break; } break; - case '$': strcat( trbuf,"$" ); break; + case '$': strlcat( trbuf,"$",sizeof( trbuf ) ); break; default: continue; } c=strlen( trbuf ); -- cgit v1.2.3