[vlc-commits] [Git][videolan/vlc][3.0.x] 2 commits: rtsp_vod: check for invalid deref

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
8e61faca by François Cartegnie at 2026-08-26T03:02:12+00:00
rtsp_vod: check for invalid deref

fix #29709

- - - - -
b533d252 by François Cartegnie at 2026-08-26T03:02:12+00:00
rtsp_vod: use hxxx_iterator

- - - - -


1 changed file:

- modules/misc/rtsp.c


Changes:

=====================================
modules/misc/rtsp.c
=====================================
@@ -54,6 +54,8 @@
 # include <xlocale.h>
 #endif
 
+#include "../packetizer/hxxx_nal.h"
+
 /*****************************************************************************
  * Module descriptor
  *****************************************************************************/
@@ -535,68 +537,29 @@ static int MediaAddES( vod_t *p_vod, vod_media_t *p_media, const es_format_t *p_
             /* FIXME AAAAAAAAAAAARRRRRRRRGGGG copied from stream_out/rtp.c */
             if( p_fmt->i_extra > 0 )
             {
-                uint8_t *p_buffer = p_fmt->p_extra;
-                int     i_buffer = p_fmt->i_extra;
                 char    *p_64_sps = NULL;
                 char    *p_64_pps = NULL;
                 char    hexa[6+1];
 
-                while( i_buffer > 4 )
-                {
-                    int i_offset    = 0;
-                    int i_size      = 0;
-
-                    while( p_buffer[0] != 0 || p_buffer[1] != 0 ||
-                           p_buffer[2] != 1 )
-                    {
-                        p_buffer++;
-                        i_buffer--;
-                        if( i_buffer == 0 ) break;
-                    }
-
-                    if( i_buffer < 4 || memcmp(p_buffer, "\x00\x00\x01", 3 ) )
-                    {
-                        /* No startcode found.. */
-                        break;
-                    }
-                    p_buffer += 3;
-                    i_buffer -= 3;
-
-                    const int i_nal_type = p_buffer[0]&0x1f;
+                hxxx_iterator_ctx_t it;
+                hxxx_iterator_init( &it, p_fmt->p_extra, p_fmt->i_extra, 0 );
 
-                    i_size = i_buffer;
-                    for( i_offset = 1; i_offset+2 < i_buffer ; i_offset++)
-                    {
-                        if( !memcmp(p_buffer + i_offset, "\x00\x00\x01", 3 ) )
-                        {
-                            /* we found another startcode */
-                            while( i_offset > 0 && 0 == p_buffer[ i_offset - 1 ] )
-                                i_offset--;
-                            i_size = i_offset;
-                            break;
-                        }
-                    }
-
-                    if( i_size == 0 )
-                    {
-                        /* No-info found in nal */
-                        continue;
-                    }
-
-                    if( i_nal_type == 7 )
+                const uint8_t *p_nal;
+                size_t i_nal;
+                while( hxxx_annexb_iterate_next( &it, &p_nal, &i_nal ) && i_nal > 0 )
+                {
+                    const int i_nal_type = p_nal[0]&0x1f;
+                    if( i_nal_type == 7 && i_nal > 3 )
                     {
                         free( p_64_sps );
-                        p_64_sps = vlc_b64_encode_binary( p_buffer, i_size );
-                        /* XXX: nothing ensures that i_size >= 4 ?? */
-                        sprintf_hexa( hexa, &p_buffer[1], 3 );
+                        p_64_sps = vlc_b64_encode_binary( p_nal, i_nal );
+                        sprintf_hexa( hexa, &p_nal[1], 3 );
                     }
                     else if( i_nal_type == 8 )
                     {
                         free( p_64_pps );
-                        p_64_pps = vlc_b64_encode_binary( p_buffer, i_size );
+                        p_64_pps = vlc_b64_encode_binary( p_nal, i_nal );
                     }
-                    i_buffer -= i_size;
-                    p_buffer += i_size;
                 }
                 /* */
                 if( p_64_sps && p_64_pps )



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/0ee16d2a964428b7563951d87edc18999e82d141...b533d25285bf63a354a3cc7a242ebf12f7d1350b

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/0ee16d2a964428b7563951d87edc18999e82d141...b533d25285bf63a354a3cc7a242ebf12f7d1350b
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help