romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 23:17:19 +03:00
Code Issues Projects Releases Packages Wiki Activity

rtmp: precaution for a potential integer truncation

Browse source 
On some platforms, socket descriptors may use types larger than int.
When these values exceed INT_MAX, conversion to int can truncate to
negative values causing RTMP connection failures, and even accidentally
affect other socket when high-value descriptors map to existing
lower-value sockets after integer conversion. This check ensures socket
values are within the safe range before passing them to the RTMP
library.

Closes #19399
This commit is contained in:
x2018 2025-11-08 00:43:51 +08:00 • committed by Daniel Stenberg
parent 2d99cf0761
commit a6fcaf2958
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/curl_rtmp.c
View file

@ -256,6 +256,11 @@ static CURLcode rtmp_connect(struct Curl_easy *data, bool *done)
if(!r)
return CURLE_FAILED_INIT;
if(conn->sock[FIRSTSOCKET] > INT_MAX) {
/* The socket value is invalid for rtmp. */
return CURLE_FAILED_INIT;
}
r->m_sb.sb_socket = (int)conn->sock[FIRSTSOCKET];
/* We have to know if it is a write before we send the