rtsp: Check payload length during parsing.

Author: Pavel Siska

process/rtsp.cpp

@@ -49,6 +49,7 @@
 #include <unirec/unirec.h>
 #endif
 
+#include "common.hpp"
 #include "rtsp.hpp"
 
 namespace ipxp {
@@ -204,6 +205,7 @@ bool RTSPPlugin::parse_rtsp_request(const char *data, int payload_len, RecordExt
    const char *begin;
    const char *end;
    const char *keyval_delimiter;
+   size_t remaining;
 
    total++;
 
@@ -226,14 +228,20 @@ bool RTSPPlugin::parse_rtsp_request(const char *data, int payload_len, RecordExt
     */
 
    /* Find begin of URI. */
-   begin = strchr(data, ' ');
+   begin = static_cast<const char *>(memchr(data, ' ', payload_len));
    if (begin == nullptr) {
       DEBUG_MSG("Parser quits:\tnot a rtsp request header\n");
       return false;
    }
 
    /* Find end of URI. */
-   end = strchr(begin + 1, ' ');
+   
+   if (check_payload_len(payload_len, (begin + 1) - data)) {
+      DEBUG_MSG("Parser quits:\tpayload end\n");
+      return false;
+   }
+   remaining = payload_len - ((begin + 1) - data);
+   end = static_cast<const char *>(memchr(begin + 1, ' ', remaining));
    if (end == nullptr) {
       DEBUG_MSG("Parser quits:\trequest is fragmented\n");
       return false;
@@ -260,7 +268,12 @@ bool RTSPPlugin::parse_rtsp_request(const char *data, int payload_len, RecordExt
    DEBUG_MSG("\tURI: %s\n",      rec->uri);
 
    /* Find begin of next line after request line. */
-   begin = strchr(end, RTSP_LINE_DELIMITER);
+   if (check_payload_len(payload_len, end - data)) {
+      DEBUG_MSG("Parser quits:\tpayload end\n");
+      return false;
+   }
+   remaining = payload_len - (end - data);
+   begin = static_cast<const char *>(memchr(end, RTSP_LINE_DELIMITER, remaining));
    if (begin == nullptr) {
       DEBUG_MSG("Parser quits:\tNo line delim after request line\n");
       return false;
@@ -279,8 +292,9 @@ bool RTSPPlugin::parse_rtsp_request(const char *data, int payload_len, RecordExt
    rec->user_agent[0] = 0;
    /* Process headers. */
    while (begin - data < payload_len) {
-      end = strchr(begin, RTSP_LINE_DELIMITER);
-      keyval_delimiter = strchr(begin, RTSP_KEYVAL_DELIMITER);
+      remaining = payload_len - (begin - data);
+      end = static_cast<const char *>(memchr(begin, RTSP_LINE_DELIMITER, remaining));
+      keyval_delimiter = static_cast<const char *>(memchr(begin, RTSP_KEYVAL_DELIMITER, remaining));
 
       int tmp = end - begin;
       if (tmp == 0 || tmp == 1) { /* Check for blank line with \r\n or \n ending. */
@@ -325,6 +339,7 @@ bool RTSPPlugin::parse_rtsp_response(const char *data, int payload_len, RecordEx
    const char *begin;
    const char *end;
    const char *keyval_delimiter;
+   size_t remaining;
    int code;
 
    total++;
@@ -354,14 +369,19 @@ bool RTSPPlugin::parse_rtsp_response(const char *data, int payload_len, RecordEx
     */
 
    /* Find begin of status code. */
-   begin = strchr(data, ' ');
+   begin = static_cast<const char *>(memchr(data, ' ', payload_len));
    if (begin == nullptr) {
       DEBUG_MSG("Parser quits:\tnot a rtsp response header\n");
       return false;
    }
 
    /* Find end of status code. */
-   end = strchr(begin + 1, ' ');
+   if (check_payload_len(payload_len, (begin + 1) - data)) {
+      DEBUG_MSG("Parser quits:\tpayload end\n");
+      return false;
+   }
+   remaining = payload_len - ((begin + 1) - data);
+   end = static_cast<const char *>(memchr(begin + 1, ' ', remaining));
    if (end == nullptr) {
       DEBUG_MSG("Parser quits:\tresponse is fragmented\n");
       return false;
@@ -385,7 +405,12 @@ bool RTSPPlugin::parse_rtsp_response(const char *data, int payload_len, RecordEx
    rec->code = code;
 
    /* Find begin of next line after request line. */
-   begin = strchr(end, RTSP_LINE_DELIMITER);
+   if (check_payload_len(payload_len, end - data)) {
+      DEBUG_MSG("Parser quits:\tpayload end\n");
+      return false;
+   }
+   remaining = payload_len - (end - data);
+   begin = static_cast<const char *>(memchr(end, RTSP_LINE_DELIMITER, remaining));
    if (begin == nullptr) {
       DEBUG_MSG("Parser quits:\tNo line delim after request line\n");
       return false;
@@ -404,8 +429,9 @@ bool RTSPPlugin::parse_rtsp_response(const char *data, int payload_len, RecordEx
    rec->content_type[0] = 0;
    /* Process headers. */
    while (begin - data < payload_len) {
-      end = strchr(begin, RTSP_LINE_DELIMITER);
-      keyval_delimiter = strchr(begin, RTSP_KEYVAL_DELIMITER);
+      remaining = payload_len - (begin - data);
+      end = static_cast<const char *>(memchr(begin, RTSP_LINE_DELIMITER, remaining));
+      keyval_delimiter = static_cast<const char *>(memchr(begin, RTSP_KEYVAL_DELIMITER, remaining));
 
       int tmp = end - begin;
       if (tmp == 0 || tmp == 1) { /* Check for blank line with \r\n or \n ending. */