comparison rtsp.c @ 706:fc254f396f15 libavformat

buffer overflow in sdp_probe() fix by (Gildas Bazin )gbazin altern org)

705:594a9b0cacf5

    .read_pause = rtsp_read_pause,
};

static int sdp_probe(AVProbeData *p1)
{
    const char *p;

    /* we look for a line beginning "c=IN IP4" */
    p = p1->buf;
    while (*p != '\0') {
        if (strstart(p, "c=IN IP4", NULL))
            return AVPROBE_SCORE_MAX / 2;
        p = strchr(p, '\n');
        if (!p)
            break;
        p++;
        if (*p == '\r')
            p++;
    }
    return 0;
}

706:fc254f396f15

    .read_pause = rtsp_read_pause,
};

static int sdp_probe(AVProbeData *p1)
{
    const char *p = p1->buf, *p_end = p1->buf + p1->buf_size;

    /* we look for a line beginning "c=IN IP4" */
    while (p < p_end && *p != '\0') {
        if (p + sizeof("c=IN IP4") - 1 < p_end && strstart(p, "c=IN IP4", NULL))
            return AVPROBE_SCORE_MAX / 2;

        while(p < p_end - 1 && *p != '\n') p++;
        if (++p >= p_end)
            break;
        if (*p == '\r')
            p++;
    }
    return 0;
}