Skip to content

V
vlc
Commit 798b3fbd authored by Christophe Mutricy's avatar Christophe Mutricy
Browse files
Options

Backport [24440]. Avoid buffer overflow. Fix #1442. Refs CVE-2008-0295 CVE-2008-0296

parent bfbe06c9
Hide whitespace changes
Inline Side-by-side
Showing with 29 additions and 23 deletions
modules/access/rtsp/real_sdpplin.c
View file @ 798b3fbd
......@@ -24,6 +24,7 @@
*/
#include "real.h"
#define BUFLEN 32000
/*
* Decodes base64 strings (based upon b64 package)
......@@ -88,7 +89,7 @@ static char *nl(char *data) {
return (nlptr) ? nlptr + 1 : NULL;
}
static int filter(const char *in, const char *filter, char **out) {
static int filter(const char *in, const char *filter, char **out, size_t outlen) {
int flen=strlen(filter);
int len;
......@@ -100,6 +101,11 @@ static int filter(const char *in, const char *filter, char **out) {
if(in[flen]=='"') flen++;
if(in[len-1]==13) len--;
if(in[len-1]=='"') len--;
if( len-flen+1 > outlen )
{
printf("Discarding end of string to avoid overflow");
len=outlen+flen-1;
}
memcpy(*out, in+flen, len-flen+1);
(*out)[len-flen]=0;
return len-flen;
......@@ -110,8 +116,8 @@ static int filter(const char *in, const char *filter, char **out) {
static sdpplin_stream_t *sdpplin_parse_stream(char **data) {
sdpplin_stream_t *desc = malloc(sizeof(sdpplin_stream_t));
char *buf = malloc(32000);
char *decoded = malloc(32000);
char *buf = malloc(BUFLEN);
char *decoded = malloc(BUFLEN);
int handled;
if( !desc ) return NULL;
......@@ -120,7 +126,7 @@ static sdpplin_stream_t *sdpplin_parse_stream(char **data) {
if( !buf ) goto error;
if( !decoded ) goto error;
if (filter(*data, "m=", &buf)) {
if (filter(*data, "m=", &buf, BUFLEN)) {
desc->id = strdup(buf);
} else {
lprintf("sdpplin: no m= found.\n");
......@@ -131,53 +137,53 @@ static sdpplin_stream_t *sdpplin_parse_stream(char **data) {
while (*data && **data && *data[0]!='m') {
handled=0;
if(filter(*data,"a=control:streamid=",&buf)) {
if(filter(*data,"a=control:streamid=",&buf, BUFLEN)) {
desc->stream_id=atoi(buf);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=MaxBitRate:integer;",&buf)) {
if(filter(*data,"a=MaxBitRate:integer;",&buf, BUFLEN)) {
desc->max_bit_rate=atoi(buf);
if (!desc->avg_bit_rate)
desc->avg_bit_rate=desc->max_bit_rate;
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=MaxPacketSize:integer;",&buf)) {
if(filter(*data,"a=MaxPacketSize:integer;",&buf, BUFLEN)) {
desc->max_packet_size=atoi(buf);
if (!desc->avg_packet_size)
desc->avg_packet_size=desc->max_packet_size;
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=StartTime:integer;",&buf)) {
if(filter(*data,"a=StartTime:integer;",&buf, BUFLEN)) {
desc->start_time=atoi(buf);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=Preroll:integer;",&buf)) {
if(filter(*data,"a=Preroll:integer;",&buf, BUFLEN)) {
desc->preroll=atoi(buf);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=length:npt=",&buf)) {
if(filter(*data,"a=length:npt=",&buf, BUFLEN)) {
desc->duration=(uint32_t)(atof(buf)*1000);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=StreamName:string;",&buf)) {
if(filter(*data,"a=StreamName:string;",&buf, BUFLEN)) {
desc->stream_name=strdup(buf);
desc->stream_name_size=strlen(desc->stream_name);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=mimetype:string;",&buf)) {
if(filter(*data,"a=mimetype:string;",&buf, BUFLEN)) {
desc->mime_type=strdup(buf);
desc->mime_type_size=strlen(desc->mime_type);
handled=1;
*data=nl(*data);
}
if(filter(*data,"a=OpaqueData:buffer;",&buf)) {
if(filter(*data,"a=OpaqueData:buffer;",&buf, BUFLEN)) {
decoded = b64_decode(buf, decoded, &(desc->mlti_data_size));
desc->mlti_data = malloc(sizeof(char)*desc->mlti_data_size);
memcpy(desc->mlti_data, decoded, desc->mlti_data_size);
......@@ -185,7 +191,7 @@ static sdpplin_stream_t *sdpplin_parse_stream(char **data) {
*data=nl(*data);
lprintf("mlti_data_size: %i\n", desc->mlti_data_size);
}
if(filter(*data,"a=ASMRuleBook:string;",&buf)) {
if(filter(*data,"a=ASMRuleBook:string;",&buf, BUFLEN)) {
desc->asm_rule_book=strdup(buf);
handled=1;
*data=nl(*data);
......@@ -216,8 +222,8 @@ sdpplin_t *sdpplin_parse(char *data) {
sdpplin_t *desc = malloc(sizeof(sdpplin_t));
sdpplin_stream_t *stream;
char *buf=malloc(3200);
char *decoded=malloc(3200);
char *buf=malloc(BUFLEN);
char *decoded=malloc(BUFLEN);
int handled;
int len;
......@@ -236,43 +242,43 @@ sdpplin_t *sdpplin_parse(char *data) {
while (data && *data) {
handled=0;
if (filter(data, "m=", &buf)) {
if (filter(data, "m=", &buf, BUFLEN)) {
stream=sdpplin_parse_stream(&data);
lprintf("got data for stream id %u\n", stream->stream_id);
desc->stream[stream->stream_id]=stream;
continue;
}
if(filter(data,"a=Title:buffer;",&buf)) {
if(filter(data,"a=Title:buffer;",&buf, BUFLEN)) {
decoded=b64_decode(buf, decoded, &len);
desc->title=strdup(decoded);
handled=1;
data=nl(data);
}
if(filter(data,"a=Author:buffer;",&buf)) {
if(filter(data,"a=Author:buffer;",&buf, BUFLEN)) {
decoded=b64_decode(buf, decoded, &len);
desc->author=strdup(decoded);
handled=1;
data=nl(data);
}
if(filter(data,"a=Copyright:buffer;",&buf)) {
if(filter(data,"a=Copyright:buffer;",&buf, BUFLEN)) {
decoded=b64_decode(buf, decoded, &len);
desc->copyright=strdup(decoded);
handled=1;
data=nl(data);
}
if(filter(data,"a=Abstract:buffer;",&buf)) {
if(filter(data,"a=Abstract:buffer;",&buf, BUFLEN)) {
decoded=b64_decode(buf, decoded, &len);
desc->abstract=strdup(decoded);
handled=1;
data=nl(data);
}
if(filter(data,"a=StreamCount:integer;",&buf)) {
if(filter(data,"a=StreamCount:integer;",&buf, BUFLEN)) {
desc->stream_count=atoi(buf);
desc->stream = malloc(sizeof(sdpplin_stream_t*)*desc->stream_count);
handled=1;
data=nl(data);
}
if(filter(data,"a=Flags:integer;",&buf)) {
if(filter(data,"a=Flags:integer;",&buf, BUFLEN)) {
desc->flags=atoi(buf);
handled=1;
data=nl(data);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment