PR #20857 opened by caifan URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20857 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20857.patch
GCC with -Wformat-truncation warns that writing the transport string with snprintf may result in truncation, as up to 4095 bytes from '%s' are written into a buffer with only 4085 bytes available (after accounting for "Transport: " and "\r\n"). Signed-off-by: caifan3 <[email protected]> >From 2ae2910d2d55ca6a8f8145fc3160589d02415801 Mon Sep 17 00:00:00 2001 From: caifan3 <[email protected]> Date: Fri, 7 Nov 2025 16:39:56 +0800 Subject: [PATCH] libavformat/rtsp: fix potential buffer truncation in ff_rtsp_make_setup_request GCC with -Wformat-truncation warns that writing the transport string with snprintf may result in truncation, as up to 4095 bytes from '%s' are written into a buffer with only 4085 bytes available (after accounting for "Transport: " and "\r\n"). Signed-off-by: caifan3 <[email protected]> --- libavformat/rtsp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index e8f44e571a..5742aecce1 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -1499,7 +1499,7 @@ int ff_rtsp_make_setup_request(AVFormatContext *s, const char *host, int port, int lower_transport, const char *real_challenge) { RTSPState *rt = s->priv_data; - int rtx = 0, j, i, err, interleave = 0, port_off = 0; + int rtx = 0, j, i, err, len, interleave = 0, port_off = 0; RTSPStream *rtsp_st; RTSPMessageHeader reply1, *reply = &reply1; char cmd[MAX_URL_SIZE]; @@ -1631,9 +1631,10 @@ int ff_rtsp_make_setup_request(AVFormatContext *s, const char *host, int port, } else if (rt->server_type == RTSP_SERVER_REAL || rt->server_type == RTSP_SERVER_WMS) av_strlcat(transport, ";mode=play", sizeof(transport)); - snprintf(cmd, sizeof(cmd), - "Transport: %s\r\n", - transport); + len = snprintf(cmd, sizeof(cmd), + "Transport: %s\r\n", + transport); + av_assert0(len >= 0 && len < sizeof(cmd)); if (rt->accept_dynamic_rate) av_strlcat(cmd, "x-Dynamic-Rate: 0\r\n", sizeof(cmd)); if (CONFIG_RTPDEC && i == 0 && rt->server_type == RTSP_SERVER_REAL) { -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
