romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-31 07:58:04 +03:00
Code Issues Projects Releases Packages Wiki Activity

rtsp: reject control bytes in stream URI, transport and session ID

Browse source
This commit is contained in:
Alhuda Khan 2026-07-13 22:00:37 +05:30
parent 30d7440295
commit f447e008fd
5 changed files with 185 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

29
lib/rtsp.c
View file

@ -270,6 +270,20 @@ static CURLcode rtsp_setup_body(struct Curl_easy *data,
return result;
}
/* A value curl writes into an RTSP request line or header must not carry a
control byte: a CR or LF would end the line and let extra request lines be
injected into the control stream. */
static bool rtsp_has_ctrl(const char *string)
{
const unsigned char *s = (const unsigned char *)string;
while(*s) {
if(*s < 0x20)
return TRUE;
s++;
}
return FALSE;
}
static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
{
struct connectdata *conn = data->conn;
@ -359,6 +373,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
}
p_session_id = data->set.str[STRING_RTSP_SESSION_ID];
if(p_session_id && rtsp_has_ctrl(p_session_id)) {
failf(data, "Control byte in RTSP session ID");
result = CURLE_BAD_FUNCTION_ARGUMENT;
goto out;
}
if(!p_session_id &&
(rtspreq & ~(Curl_RtspReq)(RTSPREQ_OPTIONS |
RTSPREQ_DESCRIBE |
@ -372,6 +391,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
/* Stream URI. Default to server '*' if not specified */
if(data->set.str[STRING_RTSP_STREAM_URI]) {
p_stream_uri = data->set.str[STRING_RTSP_STREAM_URI];
if(rtsp_has_ctrl(p_stream_uri)) {
failf(data, "Control byte in RTSP stream URI");
result = CURLE_BAD_FUNCTION_ARGUMENT;
goto out;
}
}
else {
p_stream_uri = "*";
@ -382,6 +406,11 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
if(rtspreq == RTSPREQ_SETUP && !p_transport) {
/* New Transport: setting? */
if(data->set.str[STRING_RTSP_TRANSPORT]) {
if(rtsp_has_ctrl(data->set.str[STRING_RTSP_TRANSPORT])) {
failf(data, "Control byte in RTSP transport");
result = CURLE_BAD_FUNCTION_ARGUMENT;
goto out;
}
curlx_free(data->state.aptr.rtsp_transport);
data->state.aptr.rtsp_transport =
curl_maprintf("Transport: %s\r\n",

3
tests/data/Makefile.am
View file

@ -97,7 +97,8 @@ test618 test619 test620 test621 test622 test623 test624 test625 test626 \
test627 test628 test629 test630 test631 test632 test633 test634 test635 \
test636 test637 test638 test639 test640 test641 test642 test643 test644 \
test645 test646 test647 test648 test649 test650 test651 test652 test653 \
test654 test655 test656 test658 test659 test660 test661 test662 test663 \
test654 test655 test656 test657 test658 test659 test660 test661 test662 \
test663 \
test664 test665 test666 test667 test668 test669 test670 test671 test672 \
test673 test674 test675 test676 test677 test678 test679 test680 test681 \
test682 test683 test684 test685 test686 test687 test688 test689 test690 \

49
tests/data/test657 Normal file
View file

@ -0,0 +1,49 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
RTSP
RTSP CRLF injection
</keywords>
</info>
# Server-side
<reply>
<data crlf="headers">
RTSP/1.0 200 OK
Server: RTSPD/libcurl-test
CSeq: 1
Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE
Curl-Private: swsclose
</data>
</reply>
# Client-Side
<client>
<server>
rtsp
</server>
<tool>
lib%TESTNUMBER
</tool>
<name>
RTSP reject control bytes in stream URI, transport and session ID
</name>
<command>
rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER
</command>
</client>
# Only the legitimate OPTIONS reaches the wire; the three requests carrying a
# CR or LF are refused before anything is sent.
<verify>
<protocol crlf="yes">
OPTIONS rtsp://%HOSTIP:%RTSPPORT/%TESTNUMBER RTSP/1.0
CSeq: 1
</protocol>
</verify>
</testcase>

3
tests/libtest/Makefile.inc
View file

@ -79,7 +79,8 @@ TESTS_C = \
lib586.c lib589.c lib590.c lib591.c \
lib597.c lib598.c lib599.c \
lib643.c \
lib650.c lib651.c lib652.c lib653.c lib654.c lib655.c lib658.c lib659.c \
lib650.c lib651.c lib652.c lib653.c lib654.c lib655.c lib657.c lib658.c \
lib659.c \
lib661.c lib666.c lib667.c lib668.c \
lib670.c lib674.c lib676.c lib677.c lib678.c \
lib694.c lib695.c \

103
tests/libtest/lib657.c Normal file
View file

@ -0,0 +1,103 @@
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "first.h"
/*
* A CR or LF in an RTSP stream URI, Transport or Session ID must be rejected
* before the request is put on the control stream, otherwise the byte splits
* the request line/header and smuggles a second request.
*/
static CURLcode test_lib657(const char *URL)
{
CURLcode result = TEST_ERR_MAJOR_BAD;
CURL *curl;
if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
curl_mfprintf(stderr, "curl_global_init() failed\n");
return TEST_ERR_MAJOR_BAD;
}
curl = curl_easy_init();
if(!curl) {
curl_mfprintf(stderr, "curl_easy_init() failed\n");
curl_global_cleanup();
return TEST_ERR_MAJOR_BAD;
}
easy_setopt(curl, CURLOPT_HEADERDATA, stdout);
easy_setopt(curl, CURLOPT_WRITEDATA, stdout);
easy_setopt(curl, CURLOPT_URL, URL);
/* a plain OPTIONS so the control connection is set up and the happy path is
exercised */
easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS);
result = curl_easy_perform(curl);
if(result)
goto test_cleanup;
/* CRLF in the stream URI must be refused */
easy_setopt(curl, CURLOPT_RTSP_STREAM_URI,
"rtsp://example/\r\nOPTIONS rtsp://evil/ RTSP/1.0");
result = curl_easy_perform(curl);
if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
curl_mfprintf(stderr, "control byte in stream URI not rejected: %d\n",
(int)result);
result = TEST_ERR_FAILURE;
goto test_cleanup;
}
/* CRLF in the Transport header must be refused */
easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
easy_setopt(curl, CURLOPT_RTSP_TRANSPORT,
"RAW/RAW/UDP;unicast\r\nInjected: 1");
easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_SETUP);
result = curl_easy_perform(curl);
if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
curl_mfprintf(stderr, "control byte in transport not rejected: %d\n",
(int)result);
result = TEST_ERR_FAILURE;
goto test_cleanup;
}
/* CRLF in the Session ID must be refused */
easy_setopt(curl, CURLOPT_RTSP_STREAM_URI, URL);
easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, "1234\r\nInjected: 1");
easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_PLAY);
result = curl_easy_perform(curl);
if(result != CURLE_BAD_FUNCTION_ARGUMENT) {
curl_mfprintf(stderr, "control byte in session ID not rejected: %d\n",
(int)result);
result = TEST_ERR_FAILURE;
goto test_cleanup;
}
result = CURLE_OK;
test_cleanup:
curl_easy_cleanup(curl);
curl_global_cleanup();
return result;
}