git.videolan.org
/
vlc.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
520eaf2
)
realrtsp: fix read after the end of the string if the input buffer length isn't a...
author
Rémi Duraffort
<ivoire@videolan.org>
Fri, 12 Dec 2008 21:12:50 +0000
(22:12 +0100)
committer
Rémi Duraffort
<ivoire@videolan.org>
Fri, 12 Dec 2008 21:12:50 +0000
(22:12 +0100)
modules/access/rtsp/real_sdpplin.c
patch
|
blob
|
history
diff --git
a/modules/access/rtsp/real_sdpplin.c
b/modules/access/rtsp/real_sdpplin.c
index
3f40947
..
64e043a
100644
(file)
--- a/
modules/access/rtsp/real_sdpplin.c
+++ b/
modules/access/rtsp/real_sdpplin.c
@@
-54,10
+54,11
@@
static char *b64_decode(const char *in, char *out, int *size) {
k=0;
/*CONSTANTCONDITION*/
k=0;
/*CONSTANTCONDITION*/
- for (j=0; j<strlen(in); j+=4) {
+ int in_len = strlen(in);
+ for (j=0; j < in_len; j+=4) {
char a[4], b[4];
char a[4], b[4];
- for (i = 0; i < 4; i++) {
+ for (i = 0; i < 4
&& j + i < in_len
; i++) {
int c = in[i+j];
if (dtable[c] & 0x80) {
int c = in[i+j];
if (dtable[c] & 0x80) {
@@
-388,3
+389,4
@@
void sdpplin_free(sdpplin_t *description) {
free( description->range );
free( description );
}
free( description->range );
free( description );
}
+