10000 rtmp: check upper bound for amf array by alfredh · Pull Request #441 · baresip/re · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

rtmp: check upper bound for amf array #441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 16, 2022
Merged

rtmp: check upper bound for amf array #441

merged 1 commit into from
Jul 16, 2022

Conversation

alfredh
Copy link
Contributor
@alfredh alfredh commented Jul 16, 2022 •
edited
Loading

reported by Coverity:

** CID 354662:  Insecure data handling  (TAINTED_SCALAR)
/src/rtmp/amf_dec.c: 175 in amf_decode_value()

________________________________________________________________________________________________________
*** CID 354662:  Insecure data handling  (TAINTED_SCALAR)
/src/rtmp/amf_dec.c: 175 in amf_decode_value()
169     			return EPROTO;
170
171     		err = odict_alloc(&object, 32);
172     		if (err)
173     			return err;
174
>>>     CID 354662:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "array_len" as a loop boundary.
175     		for (i=0; i<array_len; i++) {
176
177     			char ix[32];
178
179     			re_snprintf(ix, sizeof(ix), "%u", i);
180

@alfredh
rtmp: check upper bound for amf array
a2407f8 
reported by Coverity:

** CID 354662:  Insecure data handling  (TAINTED_SCALAR)
/src/rtmp/amf_dec.c: 175 in amf_decode_value()

________________________________________________________________________________________________________
*** CID 354662:  Insecure data handling  (TAINTED_SCALAR)
/src/rtmp/amf_dec.c: 175 in amf_decode_value()
169     			return EPROTO;
170
171     		err = odict_alloc(&object, 32);
172     		if (err)
173     			return err;
174
>>>     CID 354662:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "array_len" as a loop boundary.
175     		for (i=0; i<array_len; i++) {
176
177     			char ix[32];
178
179     			re_snprintf(ix, sizeof(ix), "%u", i);
180
@sreimers sreimers merged commit 955c4a9 into main Jul 16, 2022
@sreimers sreimers deleted the rtmp_amfdec branch July 16, 2022 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@alfredh @sreimers
0