[MPlayer-cvslog] r21799 - in trunk/stream/realrtsp: asmrp.c asmrp.h real.c

[rtogni]

Author: rtogni
Date: Sun Dec 31 14:27:53 2006
New Revision: 21799

Modified:
   trunk/stream/realrtsp/asmrp.c
   trunk/stream/realrtsp/asmrp.h
   trunk/stream/realrtsp/real.c

Log:
Fix potential buffer overflow in asm rules matching code


Modified: trunk/stream/realrtsp/asmrp.c
==============================================================================
--- trunk/stream/realrtsp/asmrp.c	(original)
+++ trunk/stream/realrtsp/asmrp.c	Sun Dec 31 14:27:53 2006
@@ -41,6 +41,7 @@
 #include <stdio.h>
 #include <string.h>
 #include "mp_msg.h"
+#include "asmrp.h"
 
 /*
 #define LOG
@@ -646,8 +647,11 @@
 #ifdef LOG
       printf ("rule #%d is true\n", rule_num);
 #endif
-      matches[num_matches] = rule_num;
-      num_matches++;
+      if(num_matches < MAX_RULEMATCHES - 1)
+        matches[num_matches++] = rule_num;
+      else
+        mp_msg(MSGT_STREAM, MSGL_ERR,
+	  "Ignoring matched asm rule %d, too many matched rules.\n", rule_num);
     }
 
     rule_num++;

Modified: trunk/stream/realrtsp/asmrp.h
==============================================================================
--- trunk/stream/realrtsp/asmrp.h	(original)
+++ trunk/stream/realrtsp/asmrp.h	Sun Dec 31 14:27:53 2006
@@ -40,6 +40,8 @@
 #ifndef HAVE_ASMRP_H
 #define HAVE_ASMRP_H
 
+#define MAX_RULEMATCHES 16
+
 int asmrp_match (const char *rules, int bandwidth, int *matches) ;
 
 #endif

Modified: trunk/stream/realrtsp/real.c
==============================================================================
--- trunk/stream/realrtsp/real.c	(original)
+++ trunk/stream/realrtsp/real.c	Sun Dec 31 14:27:53 2006
@@ -275,7 +275,7 @@
     int j=0;
     int n;
     char b[64];
-    int rulematches[16];
+    int rulematches[MAX_RULEMATCHES];
 
 #ifdef LOG
     printf("calling asmrp_match with:\n%s\n%u\n", desc->stream[i]->asm_rule_book, bandwidth);