From 6ca16244ba70cd1c0c8d062d1416bdc79bf20898 Mon Sep 17 00:00:00 2001
From: Peter Marko <peter.marko@siemens.com>
Date: Fri, 17 Jan 2025 18:49:12 +0100
Subject: [PATCH] oggenc: Don't assume the output path ends in a file name.

oggenc attempts to create any specified directories in the output
file path if they don't exist. The parser was assuming there was
a final filename after the last directory separator, and so would
try to read off the end of the argument if it was a bare directory
such as `./` or `outdir/`. This adds a check to make sure the
scan isn't starting off the end of the path string.

Thanks to Frank-Z7 (Zeng Yunxiang) at Huazhong University of Science
and Technology (cse.hust.edu.cn) for the report.

CVE: CVE-2023-43361
Upstream-Status: Submitted [https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/7]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 oggenc/platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oggenc/platform.c b/oggenc/platform.c
index 6d9f4ef..1ff02ca 100644
--- a/oggenc/platform.c
+++ b/oggenc/platform.c
@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8)
         start = start+2;
 #endif
 
-    while((end = strpbrk(start+1, PATH_SEPS)) != NULL)
+    while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL)
     {
         int rv;
         memcpy(segment, fn, end-fn);
-- 
2.30.2

