[xine-bugs] [ xine-Bugs-1603503 ] Invalid memory access in Real Media ASM parser

[SourceForge.net <no...@so...>]

Bugs item #1603503, was opened at 2006-11-27 05:45
Message generated for change (Comment added) made by dgp85
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=109655&aid=1603503&group_id=9655

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: xine-lib
Group: v1.1.2
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Roland Kay (rkay)
>Assigned to: Diego Pettenò (dgp85)
Summary: Invalid memory access in Real Media ASM parser

Initial Comment:

If asmrp_find_id() fails to find the symbol then it will return i = -1. A warning will be generated, but the negative value will still be used to index the symbol array. The value it gets will therefore be undefined.

This will be triggered if a Real/Helix server includes an identifier that is unknown to the client in its ASM rule book.

>8 -----------------------------------------------8<

In src/input/libreal/asmrp.c:409 [asmrp_operand()]

  case ASMRP_SYM_DOLLAR:

    asmrp_get_sym (p);

    if (p->sym != ASMRP_SYM_ID) {
      printf ("error: identifier expected.\n");
      _x_abort();
    }

    i = asmrp_find_id (p, p->str);
    if (i<0) {
      lprintf ("error: unknown identifier %s\n", p->str);
    }
    ret = p->sym_tab[i].v;

    asmrp_get_sym (p);
    break;


----------------------------------------------------------------------

Comment By: Diego Pettenò (dgp85)
Date: 2006-12-25 16:39

Message:
Logged In: YES 
user_id=60011
Originator: NO

This bug entry is believed to be fixed in CVS.
Please reopen it if needed.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=109655&aid=1603503&group_id=9655