Author: hyc Date: Sun Mar 28 22:17:00 2010 New Revision: 411 Log: Check length for unescape Modified: trunk/librtmp/rtmp.c Modified: trunk/librtmp/rtmp.c ============================================================================== --- trunk/librtmp/rtmp.c Sun Mar 28 22:14:52 2010 (r410) +++ trunk/librtmp/rtmp.c Sun Mar 28 22:17:00 2010 (r411) @@ -650,6 +650,8 @@ bool RTMP_SetupURL(RTMP *r, char *url) for (p1=p2; port >0;) { if (*p1 == '\\') { int c; + if (port < 3) + return false; sscanf(p1+1, "%02x", &c); *p2++ = c; port -= 3;