Merge f447e008fd into 33a967318c

lib/rtsp.c

@@ -270,6 +270,20 @@ static CURLcode rtsp_setup_body(struct Curl_easy *data,
   return result;
 }
 
+/* A value curl writes into an RTSP request line or header must not carry a
+   control byte: a CR or LF would end the line and let extra request lines be
+   injected into the control stream. */
+static bool rtsp_has_ctrl(const char *string)
+{
+  const unsigned char *s = (const unsigned char *)string;
+  while(*s) {
+    if(*s < 0x20)
+      return TRUE;
+    s++;
+  }
+  return FALSE;
+}
+
 static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
@@ -359,6 +373,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   }
 
   p_session_id = data->set.str[STRING_RTSP_SESSION_ID];
+  if(p_session_id && rtsp_has_ctrl(p_session_id)) {
+    failf(data, "Control byte in RTSP session ID");
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
   if(!p_session_id &&
      (rtspreq & ~(Curl_RtspReq)(RTSPREQ_OPTIONS |
                                 RTSPREQ_DESCRIBE |
@@ -372,6 +391,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   /* Stream URI. Default to server '*' if not specified */
   if(data->set.str[STRING_RTSP_STREAM_URI]) {
     p_stream_uri = data->set.str[STRING_RTSP_STREAM_URI];
+    if(rtsp_has_ctrl(p_stream_uri)) {
+      failf(data, "Control byte in RTSP stream URI");
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto out;
+    }
   }
   else {
     p_stream_uri = "*";
@@ -382,6 +406,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   if(rtspreq == RTSPREQ_SETUP && !p_transport) {
     /* New Transport: setting? */
     if(data->set.str[STRING_RTSP_TRANSPORT]) {
+      if(rtsp_has_ctrl(data->set.str[STRING_RTSP_TRANSPORT])) {
+        failf(data, "Control byte in RTSP transport");
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto out;
+      }
       curlx_free(data->state.aptr.rtsp_transport);
       data->state.aptr.rtsp_transport =
         curl_maprintf("Transport: %s\r\n",

tests/data/Makefile.am

@@ -97,7 +97,8 @@ test618 test619 test620 test621 test622 test623 test624 test625 test626 \
 test627 test628 test629 test630 test631 test632 test633 test634 test635 \
 test636 test637 test638 test639 test640 test641 test642 test643 test644 \
 test645 test646 test647 test648 test649 test650 test651 test652 test653 \
-test654 test655 test656 test658 test659 test660 test661 test662 test663 \
+test654 test655 test656 test657 test658 test659 test660 test661 test662 \
+test663 \
 test664 test665 test666 test667 test668 test669 test670 test671 test672 \
 test673 test674 test675 test676 test677 test678 test679 test680 test681 \
 test682 test683 test684 test685 test686 test687 test688 test689 test690 \

tests/data/test657

@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+RTSP
+RTSP CRLF injection
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+RTSP/1.0 200 OK
+Server: RTSPD/libcurl-test
+CSeq: 1
+Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE
+Curl-Private: swsclose
+
+</data>
+</reply>
+
+# Client-Side
+<client>
+<server>
+rtsp
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+
+<name>
+RTSP reject control bytes in stream URI, transport and session ID
+</name>
+<command>
+rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
+</command>
+</client>
+
+# Only the legitimate OPTIONS reaches the wire; the three requests carrying a
+# CR or LF are refused before anything is sent.
+<verify>
+<protocol crlf="yes">
+OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
+CSeq: 1
+
+</protocol>
+</verify>
+
+</testcase>

tests/libtest/Makefile.inc

@@ -80,7 +80,8 @@ TESTS_C = \
   lib586.c                   lib589.c lib590.c lib591.c \
   lib597.c lib598.c lib599.c \
   lib643.c \
-  lib650.c lib651.c lib652.c lib653.c lib654.c lib655.c lib658.c lib659.c \
+  lib650.c lib651.c lib652.c lib653.c lib654.c lib655.c lib657.c lib658.c \
+  lib659.c \
   lib661.c                                     lib666.c lib667.c lib668.c \
   lib670.c                            lib674.c lib676.c lib677.c lib678.c \
   lib694.c lib695.c \

tests/libtest/lib657.c

@@ -0,0 +1,103 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+/*
+ * A CR or LF in an RTSP stream URI, Transport or Session ID must be rejected
+ * before the request is put on the control stream, otherwise the byte splits
+ * the request line/header and smuggles a second request.
+ */
+static CURLcode test_lib657(const char *URL)
+{
+  CURLcode result = TEST_ERR_MAJOR_BAD;
+  CURL *curl;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    curl_mfprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    curl_mfprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
+  easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
+  easy_setopt(curl, CURLOPT_URL, URL);
+
+  /* a plain OPTIONS so the control connection is set up and the happy path is
+     exercised */
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
+  result = curl_easy_perform(curl);
+  if(result)
+    goto test_cleanup;
+
+  /* CRLF in the stream URI must be refused */
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI,
+              "rtsp://example/\r\nOPTIONS rtsp://evil/ RTSP/1.0");
+  result = curl_easy_perform(curl);
+  if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
+    curl_mfprintf(stderr, "control byte in stream URI not rejected: %d\n",
+                  (int)result);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+
+  /* CRLF in the Transport header must be refused */
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
+  easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
+              "RAW/RAW/UDP;unicast\r\nInjected: 1");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
+    curl_mfprintf(stderr, "control byte in transport not rejected: %d\n",
+                  (int)result);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+
+  /* CRLF in the Session ID must be refused */
+  easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
+  easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, "1234\r\nInjected: 1");
+  easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
+  result = curl_easy_perform(curl);
+  if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
+    curl_mfprintf(stderr, "control byte in session ID not rejected: %d\n",
+                  (int)result);
+    result = TEST_ERR_FAILURE;
+    goto test_cleanup;
+  }
+
+  result = CURLE_OK;
+
+test_cleanup:
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return result;
+}