moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 08:08:50 -05:00
Code Issues Releases Wiki Activity

rtsp: do not call fwrite() with NULL pointer FILE *

Browse Source 
If the default write callback is used and no destination has been set, a
NULL pointer would be passed to fwrite()'s 4th argument.

OSS-fuzz bug https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3327
(not publicly open yet)

Detected by OSS-fuzz
Closes #1874
This commit is contained in:
Daniel Stenberg 2017-09-08 10:20:36 +02:00
parent f8548e84ad
commit a14f7152ce
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/rtsp.c
View File

@ -756,6 +756,15 @@ CURLcode rtp_client_write(struct connectdata *conn, char *ptr, size_t len)
} }
writeit = data->set.fwrite_rtp?data->set.fwrite_rtp:data->set.fwrite_func; writeit = data->set.fwrite_rtp?data->set.fwrite_rtp:data->set.fwrite_func;
if(!data->set.fwrite_rtp && !data->set.is_fwrite_set &&
!data->set.rtp_out) {
/* if no callback is set for either RTP or default, the default function
fwrite() is utilized and that can't handle a NULL input */
failf(data, "No destination to default data callback!");
return CURLE_WRITE_ERROR;
}
wrote = writeit(ptr, 1, len, data->set.rtp_out); wrote = writeit(ptr, 1, len, data->set.rtp_out);
if(CURL_WRITEFUNC_PAUSE == wrote) { if(CURL_WRITEFUNC_PAUSE == wrote) {

BIN
tests/fuzz/curl_fuzz_data/oss-fuzz-3327 Normal file
View File

Binary file not shown.