[FFmpeg-devel] [PATCH v4] libavformat/rtsp: Change ff_sdp_parse and sdp_parse_line to handle memory alloc errors

[Rashad Tatum]

for RTSPStream and RTSPSource
---
 libavformat/rtsp.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index 5ea471b40c..d16fd24ade 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -418,7 +418,7 @@ static void parse_fmtp(AVFormatContext *s, RTSPState *rt,
     }
 }
 
-static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
+static int sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
                            int letter, const char *buf)
 {
     RTSPState *rt = s->priv_data;
@@ -436,18 +436,18 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
 
     p = buf;
     if (s1->skip_media && letter != 'm')
-        return;
+        return 0;
     switch (letter) {
     case 'c':
         get_word(buf1, sizeof(buf1), &p);
         if (strcmp(buf1, "IN") != 0)
-            return;
+            break;
         get_word(buf1, sizeof(buf1), &p);
         if (strcmp(buf1, "IP4") && strcmp(buf1, "IP6"))
-            return;
+            break;
         get_word_sep(buf1, sizeof(buf1), "/", &p);
         if (get_sockaddr(s, buf1, &sdp_ip))
-            return;
+            break;
         ttl = 16;
         if (*p == '/') {
             p++;
@@ -493,11 +493,11 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
             rt->nb_rtsp_streams >= s->max_streams
         ) {
             s1->skip_media = 1;
-            return;
+            break;
         }
         rtsp_st = av_mallocz(sizeof(RTSPStream));
         if (!rtsp_st)
-            return;
+            return AVERROR(ENOMEM);
         rtsp_st->stream_index = -1;
         dynarray_add(&rt->rtsp_streams, &rt->nb_rtsp_streams, rtsp_st);
 
@@ -545,7 +545,7 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
         } else {
             st = avformat_new_stream(s, NULL);
             if (!st)
-                return;
+                break;
             st->id = rt->nb_rtsp_streams - 1;
             rtsp_st->stream_index = st->index;
             st->codecpar->codec_type = codec_type;
@@ -660,22 +660,22 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
             int exclude = 0;
             get_word(buf1, sizeof(buf1), &p);
             if (strcmp(buf1, "incl") && strcmp(buf1, "excl"))
-                return;
+                break;
             exclude = !strcmp(buf1, "excl");
 
             get_word(buf1, sizeof(buf1), &p);
             if (strcmp(buf1, "IN") != 0)
-                return;
+                break;
             get_word(buf1, sizeof(buf1), &p);
             if (strcmp(buf1, "IP4") && strcmp(buf1, "IP6") && strcmp(buf1, "*"))
-                return;
+                break;
             // not checking that the destination address actually matches or is wildcard
             get_word(buf1, sizeof(buf1), &p);
 
             while (*p != '\0') {
                 rtsp_src = av_mallocz(sizeof(*rtsp_src));
                 if (!rtsp_src)
-                    return;
+                    return AVERROR(ENOMEM);
                 get_word(rtsp_src->addr, sizeof(rtsp_src->addr), &p);
                 if (exclude) {
                     if (s->nb_streams == 0) {
@@ -711,12 +711,14 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
         }
         break;
     }
+
+    return 0;
 }
 
 int ff_sdp_parse(AVFormatContext *s, const char *content)
 {
     const char *p;
-    int letter, i;
+    int letter, i, err;
     char buf[SDP_MAX_SIZE], *q;
     SDPParseState sdp_parse_state = { { 0 } }, *s1 = &sdp_parse_state;
 
@@ -738,7 +740,9 @@ int ff_sdp_parse(AVFormatContext *s, const char *content)
             p++;
         }
         *q = '\0';
-        sdp_parse_line(s, s1, letter, buf);
+        err = sdp_parse_line(s, s1, letter, buf);
+        if(err < 0)
+            return AVERROR(ENOMEM);
     next_line:
         while (*p != '\n' && *p != '\0')
             p++;
-- 
2.48.1