romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

rtsp: deal with borked server responses

Browse source 
- enforce a response body length of 0, if the
  response has no Content-lenght. This is according
  to the RTSP spec.
- excess bytes in a response body are forwarded to
  the client writers which will report and fail the
  transfer

Follow-up to d7b6ce6
Fixes #12701
Closes #12706
This commit is contained in:
Stefan Eissing 2024-01-15 11:33:13 +01:00 • committed by Daniel Stenberg
parent 72bd88adde
commit 036eb150d1
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 68 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
lib/rtsp.c
View file

@ -822,11 +822,10 @@ static CURLcode rtsp_rtp_write_resp(struct Curl_easy *data,
if(!rtspc->in_header) {
/* If header parsing is done, extract interleaved RTP messages */
if((data->set.rtspreq == RTSPREQ_DESCRIBE) && (data->req.size <= -1)) {
if(data->req.size <= -1) {
/* Respect section 4.4 of rfc2326: If the Content-Length header is
absent, a length 0 must be assumed. It will prevent libcurl from
hanging on DESCRIBE request that got refused for whatever
reason */
absent, a length 0 must be assumed. */
data->req.size = 0;
data->req.download_done = TRUE;
}
result = rtsp_filter_rtp(data, buf, blen, &consumed);
@ -838,13 +837,16 @@ static CURLcode rtsp_rtp_write_resp(struct Curl_easy *data,
if(rtspc->state != RTP_PARSE_SKIP)
*done = FALSE;
/* we MUST have consumed all bytes */
DEBUGF(infof(data, "rtsp_rtp_write_resp(len=%zu, in_header=%d, done=%d)",
blen, rtspc->in_header, *done));
DEBUGASSERT(blen == 0);
if(!result && is_eos) {
result = Curl_client_write(data, CLIENTWRITE_BODY|CLIENTWRITE_EOS,
(char *)buf, 0);
/* we SHOULD have consumed all bytes, unless the response is borked.
* In which case we write out the left over bytes, letting the client
* writer deal with it (it will report EXCESS and fail the transfer). */
DEBUGF(infof(data, "rtsp_rtp_write_resp(len=%zu, in_header=%d, done=%d "
" rtspc->state=%d, req.size=%" CURL_FORMAT_CURL_OFF_T ")",
blen, rtspc->in_header, *done, rtspc->state, data->req.size));
if(!result && (is_eos || blen)) {
result = Curl_client_write(data, CLIENTWRITE_BODY|
(is_eos? CLIENTWRITE_EOS:0),
(char *)buf, blen);
}
out: