[vlc-commits] service_discovery: sap: fix potential invalid write.

[Fabian Yamaguchi]

vlc | branch: master | Fabian Yamaguchi <fyamagu at gwdg.de> | Fri Dec  5 14:24:04 2014 +0100| [85b463d526df220ffb347ae7cf3475b86392195b] | committer: Jean-Baptiste Kempf

service_discovery: sap: fix potential invalid write.

A buffer depending on the length of psz_sdp was allocated on the
stack, and therefore, allocation failure would not be
detected. Allocate the buffer on the heap instead and check for
allocation failure to avoid a potential invalid memory access in the
subsequent memcpy operation.

Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=85b463d526df220ffb347ae7cf3475b86392195b
---

 modules/services_discovery/sap.c |   19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/modules/services_discovery/sap.c b/modules/services_discovery/sap.c
index 8888215..ce6e9fa 100644
--- a/modules/services_discovery/sap.c
+++ b/modules/services_discovery/sap.c
@@ -1184,6 +1184,7 @@ static sdp_t *ParseSDP (vlc_object_t *p_obj, const char *psz_sdp)
     socklen_t glob_len = 0;
     unsigned glob_count = 1;
     int port = 0;
+    char *line = NULL;
 
     /* TODO: use iconv and charset attribute instead of EnsureUTF8 */
     while (*psz_sdp)
@@ -1191,7 +1192,19 @@ static sdp_t *ParseSDP (vlc_object_t *p_obj, const char *psz_sdp)
         /* Extract one line */
         char *eol = strchr (psz_sdp, '\n');
         size_t linelen = eol ? (size_t)(eol - psz_sdp) : strlen (psz_sdp);
-        char line[linelen + 1];
+
+        if (linelen == SIZE_MAX)
+        {
+            msg_Warn (p_obj, "overly long line.");
+            goto error;
+        }
+
+        char *line = malloc(linelen + 1);
+        if (!line)
+        {
+            goto error;
+        }
+
         memcpy (line, psz_sdp, linelen);
         line[linelen] = '\0';
 
@@ -1458,10 +1471,14 @@ static sdp_t *ParseSDP (vlc_object_t *p_obj, const char *psz_sdp)
         }
     }
 
+    if(line)
+        free(line);
     return p_sdp;
 
 error:
     FreeSDP (p_sdp);
+    if(line)
+        free(line);
     return NULL;
 }