Skip to content

[PR Revision]oggenc: Don't assume the output path ends in a file name.

dadetayo requested to merge dadetayo/vorbis-tools:fix_CVE-2023-43361 into master

oggenc attempts to create any specified directories in the output file path if they don't exist. The parser was assuming there was a final filename after the last directory separator, and so would try to read off the end of the argument if it was a bare directory such as ./ or outdir/. This adds a check to make sure the scan isn't starting off the end of the path string.

Thanks to Frank-Z7 (Zeng Yunxiang) at Huazhong University of Science and Technology (cse.hust.edu.cn) for the report.

This is a modification of open PR from @rillian

Merge request reports