On 2025-01-21 02:37, Stuart Henderson wrote:
> I tired to add support for *.sub (MicroDVD) subtitles type and it seems
> to work.
> Any thought are welcome.
patches should be generated with "make update-patches"
> Index: metadata.c
> --- metadata.c.org
> +++ metadata.c
> @@ -146,6 +146,11 @@
> strcpy(p, ".smi");
> ret = access(file, R_OK);
> }
> + if (ret != 0)
> + {
> + strcpy(p, ".sub");
> + ret = access(file, R_OK);
> + }
>
Even if the rest of the code is littered with strcpy(), it feels like
patches should not add more bad calls to it.
That function has, I think, a possible 2? bytes overflow in some
conditions. The code added in this patch would only overwrite an
existing overflow from the strcpy just above the context in the diff.
To write some valid non-strcpy code for a patch you'd need to change
the rest of tge function. Or using a larger string for the filename
would fix the overflow without touching the strcpy.
Avoiding strcpy in a patch to this codebase is really giving a false
sense of safety here though, imho. Filename strings are built up this
way in other parts of the code. Bobby Tables' mum says the SQL command
generation is dodgy too.
Perhaps we should just remove the port. It's only minimally active
upstream now, there's no movement on reported security-related bugs,
and IIRC it's not really happy on a system without inotify.
https://sourceforge.net/p/minidlna/bugs/361/
(stack buffer overflow triggerable by http request)
https://sourceforge.net/p/minidlna/bugs/356/
(setuid without setgroups)
Thanks for the answers and the feedback, I appreciate it.
If this port get remove can you recommend any alternatives?
I like that minidlna is small and simple and works well on my home LAN.
Best wishes,
Atanas
