avformat/ftp: reject CR/LF in the URL path to prevent FTP command injection

ftp_connect() interpolates the URL path into SIZE/RETR/STOR/CWD/DELE/RMD/RNFR
commands without checking for CR/LF, although it already rejects CR/LF in the
user and password fields. Reject CR/LF in s->path the same way.

Reported and reviewed by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Śmigielski.

libavformat/ftp.c

@@ -746,6 +746,11 @@ static int ftp_connect(URLContext *h, const char *url)
     av_free(s->path);
     s->path = newpath;
 
+    if (strpbrk(s->path, "\r\n")) {
+        av_log(h, AV_LOG_ERROR, "Path contains CR/LF characters\n");
+        return AVERROR(EINVAL);
+    }
+
     return 0;
 }