vlc/vlc-2.2 | branch: master | Filip Roséen <[email protected]> | Thu Feb 25 10:12:37 2016 +0100| [e1c247513c5142a6abea232bf2b2f86327ec455e] | committer: Jean-Baptiste Kempf
realrtsp: `rtsp_unscheduled_field` => bounds-check + error-check The previous code would loop forever (in two places) if this function is ever invoked, it would also read out-of-bounds if the `scheduled` queue was full. Signed-off-by: Jean-Baptiste Kempf <[email protected]> (cherry picked from commit a312b1499ca1ecfe17d967988d791b5d037fc223) Signed-off-by: Jean-Baptiste Kempf <[email protected]> > http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=e1c247513c5142a6abea232bf2b2f86327ec455e --- modules/access/rtsp/rtsp.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/modules/access/rtsp/rtsp.c b/modules/access/rtsp/rtsp.c index 34bad2b..18e9966 100644 --- a/modules/access/rtsp/rtsp.c +++ b/modules/access/rtsp/rtsp.c @@ -665,22 +665,34 @@ void rtsp_schedule_field( rtsp_client_t *rtsp, const char *data ) * removes the first scheduled field which prefix matches string. */ -void rtsp_unschedule_field( rtsp_client_t *rtsp, const char *string ) +void rtsp_unschedule_field( rtsp_client_t *rtsp, const char *needle ) { - char **ptr = rtsp->p_private->scheduled; + char **pptr; + int i; - if( !string ) return; + if (rtsp->p_private == NULL || needle == NULL) + return; - while( *ptr ) - { - if( !strncmp(*ptr, string, strlen(string)) ) break; + pptr = rtsp->p_private->scheduled; + + for (i = 0; i < MAX_FIELDS; ++i) { + if (pptr[i] == NULL) + break; + + if (!strncmp (pptr[i], needle, strlen(needle))) { + free (pptr[i]); + pptr[i] = NULL; + break; + } + } + + for (i++; i < MAX_FIELDS && pptr[i]; ++i) { + pptr[i-1] = pptr[i]; + } + + if (i < MAX_FIELDS) { + pptr[i] = NULL; } - free( *ptr ); - ptr++; - do - { - *(ptr-1) = *ptr; - } while( *ptr ); } /* _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
