From 1ac605341958564ce84a3c9784a746920c7148a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Diego=20=27Flameeyes=27=20Petten=C3=B2?=
 <flameeyes@gmail.com>
Date: Mon, 25 Dec 2006 16:21:56 +0000
Subject:   * Fix invalid memory access in Real Media SDP with tailored stream;
 reported     by Roland Kay. [bug #1602631]

CVS patchset: 8442
CVS date: 2006/12/25 16:21:56
---
 src/input/libreal/sdpplin.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/input/libreal/sdpplin.c b/src/input/libreal/sdpplin.c
index dc83c3ee1..019237243 100644
--- a/src/input/libreal/sdpplin.c
+++ b/src/input/libreal/sdpplin.c
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: sdpplin.c,v 1.7 2006/12/25 16:12:17 dgp85 Exp $
+ * $Id: sdpplin.c,v 1.8 2006/12/25 16:21:56 dgp85 Exp $
  *
  * sdp/sdpplin parser.
  *
@@ -242,11 +242,17 @@ sdpplin_t *sdpplin_parse(char *data) {
   int              handled;
   int              len;
 
+  desc->stream = NULL;
+
   while (data && *data) {
 
     handled=0;
     
     if (filter(data, "m=", &buf)) {
+      if ( ! desc->stream ) {
+	fprintf(stderr, "sdpplin.c: stream identifier found before stream count, skipping.");
+	continue;
+      }
       stream=sdpplin_parse_stream(&data);
       lprintf("got data for stream id %u\n", stream->stream_id);
       desc->stream[stream->stream_id]=stream;
-- 
cgit v1.2.3