Fix another problem in realrtsp (ported from xine-lib upstream):

* Fix invalid memory access in Real Media SDP with tailored stream; reported
by Roland Kay. [bug #1602631]

CVS patchset: 8442
CVS date: 2006/12/25 16:21:56

diff --git a/modules/access/rtsp/real_sdpplin.c b/modules/access/rtsp/real_sdpplin.c
index d262d986e11f1d84bb4887e92ea30aad2c48bd5c..0afc5a414e3a823b93cde11492d68be485fd191f 100644 (file)
--- a/modules/access/rtsp/real_sdpplin.c
+++ b/modules/access/rtsp/real_sdpplin.c
@@ -233,16 +233,23 @@ sdpplin_t *sdpplin_parse(char *data) {
     free( desc );
     return NULL;
   }
+
+  desc->stream = NULL;
+
   memset(desc, 0, sizeof(sdpplin_t));
 
   while (data && *data) {
     handled=0;
 
     if (filter(data, "m=", &buf)) {
-      stream=sdpplin_parse_stream(&data);
-      lprintf("got data for stream id %u\n", stream->stream_id);
-      desc->stream[stream->stream_id]=stream;
-      continue;
+        if ( !desc->stream ) {
+            fprintf(stderr, "sdpplin.c: stream identifier found before stream count, skipping.");
+            continue;
+        }
+        stream=sdpplin_parse_stream(&data);
+        lprintf("got data for stream id %u\n", stream->stream_id);
+        desc->stream[stream->stream_id]=stream;
+        continue;
     }
     if(filter(data,"a=Title:buffer;",&buf)) {
       decoded=b64_decode(buf, decoded, &len);