Make sure we dont write more bytes into filename than the array is long.

just a precaution in case the size of the source array is increased or
made dynamically allocateable.

Originally committed as revision 21926 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 8cc1287..7b475a9 100644 (file)
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1580,7 +1580,7 @@ static int mov_open_dref(ByteIOContext **pb, char *src, MOVDref *ref)
             }
 
         /* compose filename if next level down to target was found */
-        if (i == ref->nlvl_to - 1) {
+        if (i == ref->nlvl_to - 1 && src_path - src  < sizeof(filename)) {
             memcpy(filename, src, src_path - src);
             filename[src_path - src] = 0;