romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 18:13:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: make the RTSP version check stricter

Browse source 
- make it only accept version 1.0, as that is the version curl supports
- convert the parser to use strparse
- the status code max is now 999, but it does allow != 3 digits

Closes #16435
This commit is contained in:
Daniel Stenberg 2025-02-21 23:48:51 +01:00
parent cfc657a48d
commit 4c5099868e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 35 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

36
lib/http.c
View file

@ -3987,30 +3987,22 @@ static CURLcode http_rw_hd(struct Curl_easy *data,
}
else if(data->conn->handler->protocol & CURLPROTO_RTSP) {
const char *p = hd;
while(ISBLANK(*p))
p++;
if(!strncmp(p, "RTSP/", 5)) {
p += 5;
if(ISDIGIT(*p)) {
p++;
if((p[0] == '.') && ISDIGIT(p[1])) {
if(ISBLANK(p[2])) {
p += 3;
if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
(p[2] - '0');
p += 3;
if(ISSPACE(*p)) {
fine_statusline = TRUE;
k->httpversion = 11; /* RTSP acts like HTTP 1.1 */
}
}
}
}
struct Curl_str ver;
curl_off_t status;
/* we set the max string a little excessive to forgive some leading
spaces */
if(!Curl_str_until(&p, &ver, 32, ' ') &&
!Curl_str_single(&p, ' ') &&
!Curl_str_number(&p, &status, 999)) {
Curl_str_trimblanks(&ver);
if(Curl_str_cmp(&ver, "RTSP/1.0")) {
k->httpcode = (int)status;
fine_statusline = TRUE;
k->httpversion = 11; /* RTSP acts like HTTP 1.1 */
}
if(!fine_statusline)
return CURLE_WEIRD_SERVER_REPLY;
}
if(!fine_statusline)
return CURLE_WEIRD_SERVER_REPLY;
}
if(fine_statusline) {