PR #24902 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902.patch
Fixes: 2OgPp3duxpWM Found-by: BapToutatis Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers Signed-off-by: Michael Niedermayer <[email protected]> >From eb9cef3ef1f6adac1e701e3f5f06739a0fcb0c97 Mon Sep 17 00:00:00 2001 From: BapToutatis <[email protected]> Date: Tue, 6 Oct 2026 06:22:28 +0200 Subject: [PATCH] avformat/rtsp: limit the number of redirects Fixes: 2OgPp3duxpWM Found-by: BapToutatis Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtsp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index cdf7b7c389..eef1e10eb2 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -1935,6 +1935,7 @@ int ff_rtsp_connect(AVFormatContext *s) int port, err, tcp_fd; RTSPMessageHeader reply1, *reply = &reply1; int lower_transport_mask = 0; + int redirects = 0; int default_port = RTSP_DEFAULT_PORT; int https_tunnel = 0; char real_challenge[64] = ""; @@ -2243,6 +2244,11 @@ redirect: if (reply->status_code >=300 && reply->status_code < 400 && s->iformat) { int ret; + if (redirects++ >= 8 /* MAX_RTSP_REDIRECTS */) { + av_log(s, AV_LOG_ERROR, "Too many RTSP redirects\n"); + err = AVERROR(EIO); + goto fail2; + } if (!rtsp_url_same_origin(s->url, reply->location)) { memset(rt->auth, 0, sizeof(rt->auth)); memset(&rt->auth_state, 0, sizeof(rt->auth_state)); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
