[vlc-commits] Fix HTTP/RTSP crash on invalid request URI

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Mon Sep 26 18:28:19 2011 +0300| [a03617089bc045e343f94921f257cf71436f4812] | committer: Rémi Denis-Courmont

Fix HTTP/RTSP crash on invalid request URI

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=a03617089bc045e343f94921f257cf71436f4812
---

 src/network/httpd.c |   19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/network/httpd.c b/src/network/httpd.c
index 8e64b26..7c08192 100644
--- a/src/network/httpd.c
+++ b/src/network/httpd.c
@@ -1728,16 +1728,27 @@ static void httpd_ClientRecv( httpd_client_t *cl )
                             *p2++ = '\0';
                         }
                         if( !strncasecmp( p, ( cl->query.i_proto
-                                   == HTTPD_PROTO_HTTP ) ? "http" : "rtsp", 4 )
-                         && p[4 + !!strchr( "sS", p[4] )] == ':' )
+                             == HTTPD_PROTO_HTTP ) ? "http:" : "rtsp:", 5 ) )
                         {   /* Skip hier-part of URL (if present) */
-                            p = strchr( p, ':' ) + 1; /* skip URI scheme */
+                            p += 5;
                             if( !strncmp( p, "//", 2 ) ) /* skip authority */
                             {   /* see RFC3986 §3.2 */
                                 p += 2;
-                                while( *p && !strchr( "/?#", *p ) ) p++;
+                                p += strcspn( p, "/?#" );
                             }
                         }
+                        else
+                        if( !strncasecmp( p, ( cl->query.i_proto
+                             == HTTPD_PROTO_HTTP ) ? "https:" : "rtsps:", 6 ) )
+                        {   /* Skip hier-part of URL (if present) */
+                            p += 6;
+                            if( !strncmp( p, "//", 2 ) ) /* skip authority */
+                            {   /* see RFC3986 §3.2 */
+                                p += 2;
+                                p += strcspn( p, "/?#" );
+                            }
+                        }
+
                         cl->query.psz_url = strdup( p );
                         if( ( p3 = strchr( cl->query.psz_url, '?' ) )  )
                         {