buffer overflow in sdp_probe() fix by (Gildas Bazin )gbazin altern org)
Originally committed as revision 4049 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
parent
e27ca59b0e
commit
0e1ceacde9
1 changed files with 6 additions and 7 deletions
|
|
@ -1174,17 +1174,16 @@ AVInputFormat rtsp_demux = {
|
|||
|
||||
static int sdp_probe(AVProbeData *p1)
|
||||
{
|
||||
const char *p;
|
||||
const char *p = p1->buf, *p_end = p1->buf + p1->buf_size;
|
||||
|
||||
/* we look for a line beginning "c=IN IP4" */
|
||||
p = p1->buf;
|
||||
while (*p != '\0') {
|
||||
if (strstart(p, "c=IN IP4", NULL))
|
||||
while (p < p_end && *p != '\0') {
|
||||
if (p + sizeof("c=IN IP4") - 1 < p_end && strstart(p, "c=IN IP4", NULL))
|
||||
return AVPROBE_SCORE_MAX / 2;
|
||||
p = strchr(p, '\n');
|
||||
if (!p)
|
||||
|
||||
while(p < p_end - 1 && *p != '\n') p++;
|
||||
if (++p >= p_end)
|
||||
break;
|
||||
p++;
|
||||
if (*p == '\r')
|
||||
p++;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue