zotan/nginx-mod-rtmp
1
1
Fork 0
mirror of https://github.com/zotanmew/nginx-rtmp-module.git synced 2024-05-16 08:41:08 +02:00
Code Issues Projects Releases Wiki Activity

added proper file name check in play module

Browse source
This commit is contained in:
Roman Arutyunyan 2012-07-23 16:38:40 +04:00
parent 4e475cccb5
commit dea898a6ea
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
ngx_rtmp_play_module.c
View file

@ -706,14 +706,15 @@ ngx_rtmp_play_play(ngx_rtmp_session_t *s, ngx_rtmp_play_t *v)
/* check for double-dot in v->name;
* we should not move out of play directory */
p = v->name;
while (*p) {
if (*p == '.' && *(p + 1) == '.') {
for (p = v->name; *p; ++p) {
if (ngx_path_separator(p[0]) &&
p[1] == '.' && p[2] == '.' &&
ngx_path_separator(p[3]))
{
ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
"play: bad name '%s'", v->name);
return NGX_ERROR;
}
++p;
}
if (ctx == NULL) {