components/encumbered/rtmpdump/patches/04-CVE-2015-8271-2.patch

   1 From 530f9bb2a02a78c1198fb2bf0293a12d225e4691 Mon Sep 17 00:00:00 2001
   2 From: Howard Chu <hyc@highlandsun.com>
   3 Date: Mon, 14 Dec 2015 20:59:16 +0000
   4 Subject: [PATCH] More for input buffer checks
   5
   6 Fix 39ec7eda489717d503bc4cbfaa591c93205695b6
   7 move the check to allow valid loop termination
   8 ---
   9  librtmp/amf.c | 18 +++++++++---------
  10  1 file changed, 9 insertions(+), 9 deletions(-)
  11
  12 diff --git a/librtmp/amf.c b/librtmp/amf.c
  13 index d315145..1c5f99f 100644
  14 --- a/librtmp/amf.c
  15 +++ b/librtmp/amf.c
  16 @@ -1078,11 +1078,6 @@ AMF3_Decode(AMFObject *obj, const char *pBuffer, int nSize, int bAMFData)
  17           for (i = 0; i < cdnum; i++)
  18             {
  19               AVal memberName;
  20 -             len = AMF3ReadString(pBuffer, &memberName);
  21 -             RTMP_Log(RTMP_LOGDEBUG, "Member: %s", memberName.av_val);
  22 -             AMF3CD_AddProp(&cd, &memberName);
  23 -             nSize -= len;
  24 -             pBuffer += len;
  25               if (nSize <=0)
  26                 {
  27  invalid:
  28 @@ -1090,6 +1085,11 @@ invalid:
  29                     __FUNCTION__);
  30                   return nOriginalSize;
  31                 }
  32 +             len = AMF3ReadString(pBuffer, &memberName);
  33 +             RTMP_Log(RTMP_LOGDEBUG, "Member: %s", memberName.av_val);
  34 +             AMF3CD_AddProp(&cd, &memberName);
  35 +             nSize -= len;
  36 +             pBuffer += len;
  37             }
  38         }
  39
  40 @@ -1120,6 +1120,8 @@ invalid:
  41           int nRes, i;
  42           for (i = 0; i < cd.cd_num; i++)       /* non-dynamic */
  43             {
  44 +             if (nSize <=0)
  45 +               goto invalid;
  46               nRes = AMF3Prop_Decode(&prop, pBuffer, nSize, FALSE);
  47               if (nRes == -1)
  48                 RTMP_Log(RTMP_LOGDEBUG, "%s, failed to decode AMF3 property!",
  49 @@ -1130,8 +1132,6 @@ invalid:
  50
  51               pBuffer += nRes;
  52               nSize -= nRes;
  53 -             if (nSize <=0)
  54 -               goto invalid;
  55             }
  56           if (cd.cd_dynamic)
  57             {
  58 @@ -1139,13 +1139,13 @@ invalid:
  59
  60               do
  61                 {
  62 +                 if (nSize <=0)
  63 +                   goto invalid;
  64                   nRes = AMF3Prop_Decode(&prop, pBuffer, nSize, TRUE);
  65                   AMF_AddProp(obj, &prop);
  66
  67                   pBuffer += nRes;
  68                   nSize -= nRes;
  69 -                 if (nSize <=0)
  70 -                   goto invalid;
  71
  72                   len = prop.p_name.av_len;
  73                 }
  74 --
  75 1.9.1
  76