Commit a312b149 authored by Filip Roséen's avatar Filip Roséen Committed by Jean-Baptiste Kempf

realrtsp: `rtsp_unscheduled_field` => bounds-check + error-check

The previous code would loop forever (in two places) if this function is ever
invoked, it would also read out-of-bounds if the `scheduled` queue was full.
Signed-off-by: Jean-Baptiste Kempf's avatarJean-Baptiste Kempf <jb@videolan.org>
parent dafabccf
......@@ -665,22 +665,34 @@ void rtsp_schedule_field( rtsp_client_t *rtsp, const char *data )
* removes the first scheduled field which prefix matches string.
*/
void rtsp_unschedule_field( rtsp_client_t *rtsp, const char *string )
void rtsp_unschedule_field( rtsp_client_t *rtsp, const char *needle )
{
char **ptr = rtsp->p_private->scheduled;
char **pptr;
int i;
if( !string ) return;
if (rtsp->p_private == NULL || needle == NULL)
return;
while( *ptr )
{
if( !strncmp(*ptr, string, strlen(string)) ) break;
pptr = rtsp->p_private->scheduled;
for (i = 0; i < MAX_FIELDS; ++i) {
if (pptr[i] == NULL)
break;
if (!strncmp (pptr[i], needle, strlen(needle))) {
free (pptr[i]);
pptr[i] = NULL;
break;
}
}
for (i++; i < MAX_FIELDS && pptr[i]; ++i) {
pptr[i-1] = pptr[i];
}
if (i < MAX_FIELDS) {
pptr[i] = NULL;
}
free( *ptr );
ptr++;
do
{
*(ptr-1) = *ptr;
} while( *ptr );
}
/*
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment