From a14f7152ce1c25cf110d3ccf640f9d4ce17dacd3 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 8 Sep 2017 10:20:36 +0200
Subject: [PATCH] rtsp: do not call fwrite() with NULL pointer FILE *

If the default write callback is used and no destination has been set, a
NULL pointer would be passed to fwrite()'s 4th argument.

OSS-fuzz bug https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3327
(not publicly open yet)

Detected by OSS-fuzz
Closes #1874
---
 lib/rtsp.c                              |   9 +++++++++
 tests/fuzz/curl_fuzz_data/oss-fuzz-3327 | Bin 0 -> 27 bytes
 2 files changed, 9 insertions(+)
 create mode 100644 tests/fuzz/curl_fuzz_data/oss-fuzz-3327

diff --git a/lib/rtsp.c b/lib/rtsp.c
index 9bd935fd5..4bca11459 100644
--- a/lib/rtsp.c
+++ b/lib/rtsp.c
@@ -756,6 +756,15 @@ CURLcode rtp_client_write(struct connectdata *conn, char *ptr, size_t len)
   }
 
   writeit = data->set.fwrite_rtp?data->set.fwrite_rtp:data->set.fwrite_func;
+
+  if(!data->set.fwrite_rtp && !data->set.is_fwrite_set &&
+     !data->set.rtp_out) {
+    /* if no callback is set for either RTP or default, the default function
+       fwrite() is utilized and that can't handle a NULL input */
+    failf(data, "No destination to default data callback!");
+    return CURLE_WRITE_ERROR;
+  }
+
   wrote = writeit(ptr, 1, len, data->set.rtp_out);
 
   if(CURL_WRITEFUNC_PAUSE == wrote) {
diff --git a/tests/fuzz/curl_fuzz_data/oss-fuzz-3327 b/tests/fuzz/curl_fuzz_data/oss-fuzz-3327
new file mode 100644
index 0000000000000000000000000000000000000000..064cc623a91b56994e98517507d12c478c027c41
GIT binary patch
literal 27
gcmZQzWME+62r3CKu+leFU|<6B*i{r57)lxP0WJFjegFUf

literal 0
HcmV?d00001