rtsp: Make sure we don't write too many transport entries into a fixed-size array

Message ID 1429868346-90481-1-git-send-email-martin@martin.st
State Committed
Commit 4c4cc9b27b69a86e405fd7612aa0a62f3b62b027
Headers show

Commit Message

Martin Storsjö April 24, 2015, 9:39 a.m.
CC: libav-stable@libav.org
---
 libavformat/rtsp.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Vittorio Giovara April 24, 2015, 10:08 a.m. | #1
On Fri, Apr 24, 2015 at 10:39 AM, Martin Storsjö <martin@martin.st> wrote:
> CC: libav-stable@libav.org
> ---
>  libavformat/rtsp.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
> index 1b60b4f..cbea685 100644
> --- a/libavformat/rtsp.c
> +++ b/libavformat/rtsp.c
> @@ -972,6 +972,8 @@ static void rtsp_parse_transport(RTSPMessageHeader *reply, const char *p)
>              p++;
>
>          reply->nb_transports++;
> +        if (reply->nb_transports >= RTSP_MAX_TRANSPORTS)
> +            break;
>      }
>  }
>
> --
> 1.9.5 (Apple Git-50.3)

ok

Patch

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index 1b60b4f..cbea685 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -972,6 +972,8 @@  static void rtsp_parse_transport(RTSPMessageHeader *reply, const char *p)
             p++;
 
         reply->nb_transports++;
+        if (reply->nb_transports >= RTSP_MAX_TRANSPORTS)
+            break;
     }
 }