romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 21:07:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

RTSP: avoid integer overflow on funny RTSP response

Browse source 
... like a very large non-existing RTSP version number.

Added test 577 to verify.

Detected by OSS-fuzz.
Closes #1969
This commit is contained in:
Daniel Stenberg 2017-10-08 17:15:44 +02:00
parent eb04636d68
commit 232dffcf24
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 60 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

55
tests/data/test577 Normal file
View file

@ -0,0 +1,55 @@
<testcase>
#Informational
<info>
<keywords>
RTSP
OPTIONS
</keywords>
</info>
# Server-side
<reply>
<data>
RTSP/1.1234567 200 OK
Server: RTSPD/libcurl-test
CSeq: 1
Public: DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE
Curl-Private: swsclose
</data>
<datacheck>
</datacheck>
</reply>
# Client-Side
<client>
<server>
rtsp
</server>
<tool>
lib567
</tool>
<name>
Funny RTSP version in response
</name>
<command>
rtsp://%HOSTIP:%RTSPPORT/577
</command>
</client>
<verify>
<protocol>
OPTIONS rtsp://%HOSTIP:%RTSPPORT/577 RTSP/1.0
CSeq: 1
User-Agent: test567
Test-Number: 567
</protocol>
# 8 == CURLE_WEIRD_SERVER_REPLY
<errorcode>
8
</errorcode>
</verify>
</testcase>