[MPlayer-cvslog] r21800 - in branches/1.0rc1/stream/realrtsp: asmrp.c asmrp.h real.c

[rtogni]

Author: rtogni
Date: Sun Dec 31 14:46:17 2006
New Revision: 21800

Modified:
   branches/1.0rc1/stream/realrtsp/asmrp.c
   branches/1.0rc1/stream/realrtsp/asmrp.h
   branches/1.0rc1/stream/realrtsp/real.c

Log:
Fix potential buffer overflow in asm rules matching code


Modified: branches/1.0rc1/stream/realrtsp/asmrp.c
==============================================================================
--- branches/1.0rc1/stream/realrtsp/asmrp.c	(original)
+++ branches/1.0rc1/stream/realrtsp/asmrp.c	Sun Dec 31 14:46:17 2006
@@ -40,6 +40,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
+#include "asmrp.h"
 
 /*
 #define LOG
@@ -645,8 +646,10 @@
 #ifdef LOG
       printf ("rule #%d is true\n", rule_num);
 #endif
-      matches[num_matches] = rule_num;
-      num_matches++;
+      if(num_matches < MAX_RULEMATCHES - 1)
+        matches[num_matches++] = rule_num;
+      else
+        printf("Ignoring matched asm rule %d, too many matched rules.\n", rule_num);
     }
 
     rule_num++;

Modified: branches/1.0rc1/stream/realrtsp/asmrp.h
==============================================================================
--- branches/1.0rc1/stream/realrtsp/asmrp.h	(original)
+++ branches/1.0rc1/stream/realrtsp/asmrp.h	Sun Dec 31 14:46:17 2006
@@ -40,6 +40,8 @@
 #ifndef HAVE_ASMRP_H
 #define HAVE_ASMRP_H
 
+#define MAX_RULEMATCHES 16
+
 int asmrp_match (const char *rules, int bandwidth, int *matches) ;
 
 #endif

Modified: branches/1.0rc1/stream/realrtsp/real.c
==============================================================================
--- branches/1.0rc1/stream/realrtsp/real.c	(original)
+++ branches/1.0rc1/stream/realrtsp/real.c	Sun Dec 31 14:46:17 2006
@@ -271,7 +271,7 @@
     int j=0;
     int n;
     char b[64];
-    int rulematches[16];
+    int rulematches[MAX_RULEMATCHES];
 
 #ifdef LOG
     printf("calling asmrp_match with:\n%s\n%u\n", desc->stream[i]->asm_rule_book, bandwidth);