[FFmpeg-devel] [PATCH] libavformat/rtsp: fix potential buffer truncation in ff_rtsp_make_setup_request (PR #20857)

[caifan via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20857 opened by caifan
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20857
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20857.patch

GCC with -Wformat-truncation warns that writing the transport string with snprintf may result in truncation, as up to 4095 bytes from '%s'
are written into a buffer with only 4085 bytes available (after accounting for "Transport: " and "\r\n").

Signed-off-by: caifan3 <caifan3@xiaomi.com>


>From 2ae2910d2d55ca6a8f8145fc3160589d02415801 Mon Sep 17 00:00:00 2001
From: caifan3 <caifan3@xiaomi.com>
Date: Fri, 7 Nov 2025 16:39:56 +0800
Subject: [PATCH] libavformat/rtsp: fix potential buffer truncation in
 ff_rtsp_make_setup_request

GCC with -Wformat-truncation warns that writing the transport string with snprintf may result in truncation, as up to 4095 bytes from '%s'
are written into a buffer with only 4085 bytes available (after accounting for "Transport: " and "\r\n").

Signed-off-by: caifan3 <caifan3@xiaomi.com>
---
 libavformat/rtsp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index e8f44e571a..5742aecce1 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -1499,7 +1499,7 @@ int ff_rtsp_make_setup_request(AVFormatContext *s, const char *host, int port,
                               int lower_transport, const char *real_challenge)
 {
     RTSPState *rt = s->priv_data;
-    int rtx = 0, j, i, err, interleave = 0, port_off = 0;
+    int rtx = 0, j, i, err, len, interleave = 0, port_off = 0;
     RTSPStream *rtsp_st;
     RTSPMessageHeader reply1, *reply = &reply1;
     char cmd[MAX_URL_SIZE];
@@ -1631,9 +1631,10 @@ int ff_rtsp_make_setup_request(AVFormatContext *s, const char *host, int port,
         } else if (rt->server_type == RTSP_SERVER_REAL ||
                    rt->server_type == RTSP_SERVER_WMS)
             av_strlcat(transport, ";mode=play", sizeof(transport));
-        snprintf(cmd, sizeof(cmd),
-                 "Transport: %s\r\n",
-                 transport);
+        len = snprintf(cmd, sizeof(cmd),
+               "Transport: %s\r\n",
+               transport);
+        av_assert0(len >= 0 && len < sizeof(cmd));
         if (rt->accept_dynamic_rate)
             av_strlcat(cmd, "x-Dynamic-Rate: 0\r\n", sizeof(cmd));
         if (CONFIG_RTPDEC && i == 0 && rt->server_type == RTSP_SERVER_REAL) {
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org