romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 03:07:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

RTSP: avoid integer overflow on funny RTSP response

Browse source 
... like a very large non-existing RTSP version number.

Added test 577 to verify.

Detected by OSS-fuzz.
Closes #1969
This commit is contained in:
Daniel Stenberg 2017-10-08 17:15:44 +02:00
parent eb04636d68
commit 232dffcf24
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 60 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -3387,12 +3387,14 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
}
}
else if(conn->handler->protocol & CURLPROTO_RTSP) {
char separator;
nc = sscanf(HEADER1,
" RTSP/%d.%d %3d",
" RTSP/%1d.%1d%c%3d",
&rtspversion_major,
&conn->rtspversion,
&separator,
&k->httpcode);
if(nc == 3) {
if((nc == 4) && (' ' == separator)) {
conn->rtspversion += 10 * rtspversion_major;
conn->httpversion = 11; /* For us, RTSP acts like HTTP 1.1 */
}