mirrors/vlc
0
0
Fork 0
mirror of https://github.com/videolan/vlc.git synced 2024-12-05 07:46:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

When recv() returns -1 a bug is triggered inside RTPRead() and RTPChoose(). The return value of Read() is then -1. The test "if (!i_ret) return 0;" will be false and the function will continue resulting in segfault while copying from buffers that are in an undetermined state. The correct test is "if (i_ret<0) return 0;".

Browse Source
This commit is contained in:
Jean-Paul Saman 2003-07-23 07:37:34 +00:00
parent 6754c25bbc
commit 986af9f1b1
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/access/udp.c
View File

@ -2,7 +2,7 @@
* udp.c: raw UDP & RTP access plug-in
*****************************************************************************
* Copyright (C) 2001, 2002 VideoLAN
* $Id: udp.c,v 1.19 2003/03/30 18:14:35 gbazin Exp $
* $Id: udp.c,v 1.20 2003/07/23 07:37:34 jpsaman Exp $
*
* Authors: Christophe Massiot <massiot@via.ecp.fr>
* Tristan Leteurtre <tooney@via.ecp.fr>
@ -396,7 +396,7 @@ static ssize_t RTPRead( input_thread_t * p_input, byte_t * p_buffer,
* We first assume that RTP header size is the classic RTP_HEADER_LEN. */
ssize_t i_ret = Read( p_input, p_tmp_buffer, p_input->i_mtu );
if ( !i_ret ) return 0;
if ( i_ret < 0 ) return 0;
/* Parse the header and make some verifications.
* See RFC 1889 & RFC 2250. */
@ -445,7 +445,7 @@ static ssize_t RTPChoose( input_thread_t * p_input, byte_t * p_buffer,
* We first assume that RTP header size is the classic RTP_HEADER_LEN. */
ssize_t i_ret = Read( p_input, p_tmp_buffer, p_input->i_mtu );
if ( !i_ret ) return 0;
if ( i_ret < 0 ) return 0;
/* Check that it's not TS. */
if ( p_tmp_buffer[0] == 0x47 )