Bug#305343: Exploitable buffer overflow in RTSP streaming code

[Gerardo Di Giacomo]

Patch for sid attached.

Gerardo

diff -Nru /tmp/K6tJKUUwAx/xine-lib-1.0/src/input/librtsp/rtsp.c 
/tmp/ljlLpb7MdV/xine-lib-1.0/src/input/librtsp/rtsp.c
--- /tmp/K6tJKUUwAx/xine-lib-1.0/src/input/librtsp/rtsp.c       2004-07-25 
19:13:54.000000000 +0200
+++ /tmp/ljlLpb7MdV/xine-lib-1.0/src/input/librtsp/rtsp.c       2005-04-21 
02:09:50.313439360 +0200
@@ -218,6 +218,7 @@
   unsigned int answer_seq;
   char **answer_ptr=s->answers;
   int code;
+  int ans_count = 0;
   
   answer=rtsp_get(s);
   if (!answer)
@@ -268,7 +269,7 @@
     }
     *answer_ptr=answer;
     answer_ptr++;
-  } while (strlen(answer)!=0);
+  } while ((strlen(answer)!=0) && (++ans_count < MAX_FIELDS));
   
   s->cseq++;