vlc | branch: master | Will Newton <[email protected]> | Tue Feb 12 
16:33:17 2019 +0000| [18a463930511f908733e95906abbeb43430ee09d] | committer: 
Hugo Beauzée-Luyssen

upnp: Use UpnpResolveURL2 API instead of UpnpResolveURL

The UpnpResolveURL APi is very hard to use correctly and can
result in buffer overflow issues. Use the UpnpResolveURL2 API
instead and fix two small buffer overflows.

https://hackerone.com/reports/494841

Signed-off-by: Will Newton <[email protected]>
Signed-off-by: Hugo Beauzée-Luyssen <[email protected]>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=18a463930511f908733e95906abbeb43430ee09d
---

 modules/services_discovery/upnp.cpp | 27 +++++++++++----------------
 modules/stream_out/dlna/dlna.cpp    |  4 ++--
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/modules/services_discovery/upnp.cpp 
b/modules/services_discovery/upnp.cpp
index 9aa62d96d4..a467caaaa8 100644
--- a/modules/services_discovery/upnp.cpp
+++ b/modules/services_discovery/upnp.cpp
@@ -566,25 +566,20 @@ void MediaServerList::parseNewServer( IXML_Document *doc, 
const std::string &loc
             }
 
             /* Try to browse content directory. */
-            char* psz_url = ( char* ) malloc( strlen( psz_base_url ) + strlen( 
psz_control_url ) + 1 );
-            if ( psz_url )
+            char* psz_url = NULL;
+            if ( UpnpResolveURL2( psz_base_url, psz_control_url, &psz_url ) == 
UPNP_E_SUCCESS )
             {
-                if ( UpnpResolveURL( psz_base_url, psz_control_url, psz_url ) 
== UPNP_E_SUCCESS )
+                SD::MediaServerDesc* p_server = new(std::nothrow) 
SD::MediaServerDesc( psz_udn,
+                    psz_friendly_name, psz_url, iconUrl );
+                free( psz_url );
+                if ( unlikely( !p_server ) )
+                    break;
+
+                if ( !addServer( p_server ) )
                 {
-                    SD::MediaServerDesc* p_server = new(std::nothrow) 
SD::MediaServerDesc( psz_udn,
-                            psz_friendly_name, psz_url, iconUrl );
-                    free( psz_url );
-                    if ( unlikely( !p_server ) )
-                        break;
-
-                    if ( !addServer( p_server ) )
-                    {
-                        delete p_server;
-                        continue;
-                    }
+                    delete p_server;
+                    continue;
                 }
-                else
-                    free( psz_url );
             }
         }
         ixmlNodeList_free( p_service_list );
diff --git a/modules/stream_out/dlna/dlna.cpp b/modules/stream_out/dlna/dlna.cpp
index da966442f5..44fcef90ec 100644
--- a/modules/stream_out/dlna/dlna.cpp
+++ b/modules/stream_out/dlna/dlna.cpp
@@ -519,8 +519,8 @@ char *MediaRenderer::getServiceURL(const char* type, const 
char *service)
             if ( !psz_control_url )
                 continue;
 
-            char* psz_url = ( char* ) malloc( base_url.length() + strlen( 
psz_control_url ) + 1 );
-            if ( psz_url && UpnpResolveURL( base_url.c_str(), psz_control_url, 
psz_url ) == UPNP_E_SUCCESS )
+            char* psz_url = NULL;
+            if ( UpnpResolveURL2( base_url.c_str(), psz_control_url, &psz_url 
) == UPNP_E_SUCCESS )
                 return psz_url;
             return nullptr;
         }

_______________________________________________
vlc-commits mailing list
[email protected]
https://mailman.videolan.org/listinfo/vlc-commits

Reply via email to