Commit 0e1ceacd authored by Michael Niedermayer's avatar Michael Niedermayer

buffer overflow in sdp_probe() fix by (Gildas Bazin )gbazin altern org)

Originally committed as revision 4049 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent e27ca59b
......@@ -1174,17 +1174,16 @@ AVInputFormat rtsp_demux = {
static int sdp_probe(AVProbeData *p1)
{
const char *p;
const char *p = p1->buf, *p_end = p1->buf + p1->buf_size;
/* we look for a line beginning "c=IN IP4" */
p = p1->buf;
while (*p != '\0') {
if (strstart(p, "c=IN IP4", NULL))
while (p < p_end && *p != '\0') {
if (p + sizeof("c=IN IP4") - 1 < p_end && strstart(p, "c=IN IP4", NULL))
return AVPROBE_SCORE_MAX / 2;
p = strchr(p, '\n');
if (!p)
while(p < p_end - 1 && *p != '\n') p++;
if (++p >= p_end)
break;
p++;
if (*p == '\r')
p++;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment