[vlc-commits] [Git][videolan/vlc][master] 2 commits: rtpfmt: fix NULL deref

[Tristan Matthews (@tmatth)]

Tristan Matthews pushed to branch master at VideoLAN / VLC


Commits:
599b7337 by Rémi Denis-Courmont at 2026-07-21T19:01:08+00:00
rtpfmt: fix NULL deref

The attribute value can be NULL if the attribute name is not followed
by ':' meaning it has no value.

Pointed-out-by: Asif <postasif at protonmail.com>

- - - - -
d38aa472 by Rémi Denis-Courmont at 2026-07-21T19:01:08+00:00
sdp: fix potentially uninitialised value

The `%*[^/]` format specifier expects a *non-empty* string, so the first
conversion will fail if the address starts with a forward slash. This
leads to a return value of zero for `sscanf()` without "converting"
`offset` into the actual offset of the forward slash.

In that case, the offset is zero, so use that as the default initialiser
for `offset`.

Alluded-by: Asif <postasif at protonmail.com>

- - - - -


2 changed files:

- modules/access/rtp/rtpfmt.c
- modules/access/rtp/sdp.c


Changes:

=====================================
modules/access/rtp/rtpfmt.c
=====================================
@@ -236,7 +236,9 @@ int vlc_rtp_add_media_types(vlc_object_t *obj, rtp_session_t *session,
 
     /* Parse the a=rtpmap and extract a=fmtp lines */
     for (const struct vlc_sdp_attr *a = media->attrs; a != NULL; a = a->next) {
-        if (strcmp(a->name, "rtpmap") == 0) {
+        if (a->value == NULL)
+            continue;
+        else if (strcmp(a->name, "rtpmap") == 0) {
             unsigned char number, channels;
             char name[16];
             unsigned int frequency;


=====================================
modules/access/rtp/sdp.c
=====================================
@@ -100,7 +100,7 @@ bad:
     c->addr[addrlen] = '\0';
 
     if (len >= 7 && memcmp(net_type, "IN ", 3) == 0) {
-        int offset, val = -1;
+        int offset = 0, val = -1;
 
         if (memcmp(addr_type, "IP4 ", 4) == 0) {
             /* IPv4 */



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/cd9a090197e5234bc18c2558b99be09b513ec0ae...d38aa472bce9965bed2fea89222d4dc2e48cea0e

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/cd9a090197e5234bc18c2558b99be09b513ec0ae...d38aa472bce9965bed2fea89222d4dc2e48cea0e
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help