ilusha/blender
1
0
Fork 0
mirror of https://github.com/blender/blender synced 2026-09-29 04:37:17 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix buffer overflow in BLI_path_frame_strip with long extensions

Browse source 
The file extension was copied into a buffer without checking it's size.
While large extensions aren't typical, some callers used small fixed
size buffers so an unusually named file could crash.
This commit is contained in:
Campbell Barton 2023-04-20 11:45:05 +10:00 • committed by Philipp Oeser
parent f971417320
commit cddcabc409
6 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
source/blender/blenkernel/intern/cachefile.c
View file

@ -399,7 +399,7 @@ bool BKE_cachefile_filepath_get(const Main *bmain,
const int frame = (int)BKE_cachefile_time_offset(cache_file, (double)ctime, fps);
char ext[32];
BLI_path_frame_strip(r_filepath, ext);
BLI_path_frame_strip(r_filepath, ext, sizeof(ext));
BLI_path_frame(r_filepath, frame, frame_len);
BLI_path_extension_ensure(r_filepath, FILE_MAX, ext);

2
source/blender/blenkernel/intern/volume.cc
View file

@ -773,7 +773,7 @@ static void volume_filepath_get(const Main *bmain, const Volume *volume, char r_
int path_frame, path_digits;
if (volume->is_sequence && BLI_path_frame_get(r_filepath, &path_frame, &path_digits)) {
char ext[32];
BLI_path_frame_strip(r_filepath, ext);
BLI_path_frame_strip(r_filepath, ext, sizeof(ext));
BLI_path_frame(r_filepath, volume->runtime.frame, path_digits);
BLI_path_extension_ensure(r_filepath, FILE_MAX, ext);
}

2
source/blender/blenlib/BLI_path_util.h
View file

@ -317,7 +317,7 @@ bool BLI_path_frame_get(char *path, int *r_frame, int *r_digits_len) ATTR_NONNUL
* So: `/some/path_123.jpeg`
* Becomes: `/some/path_###` with `r_ext` set to `.jpeg`.
*/
void BLI_path_frame_strip(char *path, char *r_ext) ATTR_NONNULL();
void BLI_path_frame_strip(char *path, char *r_ext, size_t ext_maxlen) ATTR_NONNULL();
/**
* Check if we have '#' chars, usable for #BLI_path_frame, #BLI_path_frame_range
*/

5
source/blender/blenlib/intern/path_util.c
View file

@ -802,7 +802,7 @@ bool BLI_path_frame_get(char *path, int *r_frame, int *r_digits_len)
return false;
}
void BLI_path_frame_strip(char *path, char *r_ext)
void BLI_path_frame_strip(char *path, char *r_ext, const size_t ext_maxlen)
{
*r_ext = '\0';
if (*path == '\0') {
@ -841,8 +841,7 @@ void BLI_path_frame_strip(char *path, char *r_ext)
c++;
int suffix_length = len - (suffix - file);
BLI_strncpy(r_ext, suffix, suffix_length + 1);
BLI_strncpy(r_ext, suffix, ext_maxlen);
/* replace the number with the suffix and terminate the string */
while (digits_len--) {

2
source/blender/blenlib/tests/BLI_path_util_test.cc
View file

@ -438,7 +438,7 @@ TEST(path_util, SplitDirfile)
char path[FILE_MAX]; \
char ext[FILE_MAX]; \
BLI_strncpy(path, (input_path), FILE_MAX); \
BLI_path_frame_strip(path, ext); \
BLI_path_frame_strip(path, ext, sizeof(ext)); \
EXPECT_STREQ(path, expect_path); \
EXPECT_STREQ(ext, expect_ext); \
} \

2
source/blender/editors/space_sequencer/sequencer_add.c
View file

@ -1242,7 +1242,7 @@ void sequencer_image_seq_reserve_frames(
char ext[PATH_MAX];
char filename_stripped[PATH_MAX];
/* Strip the frame from filename and substitute with `#`. */
BLI_path_frame_strip(filename, ext);
BLI_path_frame_strip(filename, ext, sizeof(ext));
for (int i = 0; i < len; i++, se++) {
BLI_strncpy(filename_stripped, filename, sizeof(filename_stripped));