avformat/rtsp: Check number of streams in sdp_parse_line()
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 25 Jan 2019 20:30:04 +0000 (21:30 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 31 Jan 2019 16:33:50 +0000 (17:33 +0100)
Fixes: OOM

Found-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/rtsp.c

index 82c6c12..975637c 100644 (file)
@@ -454,7 +454,10 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
         } else if (!strcmp(st_type, "text")) {
             codec_type = AVMEDIA_TYPE_SUBTITLE;
         }
-        if (codec_type == AVMEDIA_TYPE_UNKNOWN || !(rt->media_type_mask & (1 << codec_type))) {
+        if (codec_type == AVMEDIA_TYPE_UNKNOWN ||
+            !(rt->media_type_mask & (1 << codec_type)) ||
+            rt->nb_rtsp_streams >= s->max_streams
+        ) {
             s1->skip_media = 1;
             return;
         }