[vlc-devel] commit: input: fix stack overflow if user feeds an overly large MRL ( Rémi Denis-Courmont )

[git version control]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Tue Mar 17 19:58:49 2009 +0200| [a276d9aa737e353a7c2bf5e19b36216a8c47528b] | committer: Rémi Denis-Courmont 

input: fix stack overflow if user feeds an overly large MRL

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=a276d9aa737e353a7c2bf5e19b36216a8c47528b
---

 src/input/input.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/input/input.c b/src/input/input.c
index 55a27f9..94b1d76 100644
--- a/src/input/input.c
+++ b/src/input/input.c
@@ -2276,13 +2276,15 @@ static int InputSourceInit( input_thread_t *p_input,
                             input_source_t *in, const char *psz_mrl,
                             const char *psz_forced_demux )
 {
-    char psz_dup[strlen(psz_mrl) + 1];
     const char *psz_access;
     const char *psz_demux;
     char *psz_path;
     double f_fps;
 
-    strcpy( psz_dup, psz_mrl );
+    char *psz_dup = strdup( psz_mrl );
+
+    if( psz_dup == NULL )
+        goto error;
 
     /* Split uri */
     input_SplitMRL( &psz_access, &psz_demux, &psz_path, psz_dup );
@@ -2553,6 +2555,8 @@ static int InputSourceInit( input_thread_t *p_input,
         }
     }
 
+    free( psz_dup );
+
     /* Set record capabilities */
     if( demux_Control( in->p_demux, DEMUX_CAN_RECORD, &in->b_can_stream_record ) )
         in->b_can_stream_record = false;
@@ -2600,6 +2604,7 @@ error:
 
     if( in->p_access )
         access_Delete( in->p_access );
+    free( psz_dup );
 
     return VLC_EGENERIC;
 }