Change #286106

Comments

avformat/rtsp: Validate the SampleRate SDP attribute
sdp_parse_line() stored the "SampleRate:integer;" attribute straight into
codecpar->sample_rate without any check:

    st = s->streams[s->nb_streams - 1];
    st->codecpar->sample_rate = atoi(p);

The value comes from the SDP description, i.e. from the server, so a
negative sample rate ends up on the stream. atoi() additionally has
undefined behaviour when the value does not fit into an int, which is
why 088f08db71 removed it from matroskaenc.

Measured with a minimal SDP fed to the sdp demuxer, before this patch:

    SampleRate:integer;48000                  -> sample_rate = 48000
    SampleRate:integer;-1                     -> sample_rate = -1
    SampleRate:integer;99999999999999999999   -> sample_rate = -1

Every other demuxer rejects such values (4xm.c, adxdec.c, 3dostr.c,
apac.c, ads.c all test sample_rate <= 0), and rtsp.c itself already
guards the rtpmap sample rate and channel count with "if (i > 0)" a few
hundred lines earlier, so only this attribute was left unchecked.

Use strtol() with base 10, check errno for ERANGE, and ignore values
outside the valid range, keeping whatever rate the rtpmap line
established.  Base 10 matters: with base 0 a leading zero would select
octal and silently reinterpret existing decimal rates.  The ERANGE test
matters where LONG_MAX == INT_MAX, since there a positive overflow
returns INT_MAX and would otherwise pass the upper bound check.

Measured after the patch, with the rtpmap rate held at 44100:

    SampleRate:integer;48000                  -> 48000 Hz
    SampleRate:integer;048000                 -> 48000 Hz
    SampleRate:integer;044100                 -> 44100 Hz
    SampleRate:integer;-1                     -> rejected, keeps 44100
    SampleRate:integer;0                      -> rejected, keeps 44100
    SampleRate:integer;99999999999999999999   -> rejected, keeps 44100

Note this is defence in depth rather than a fix for a reachable crash:
nothing in the RTP/RDT path divides by sample_rate, and avcodec.c
rejects a negative rate when the decoder is opened.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Furkan Efe Can <caglarf646@gmail.com>

Changed files

• libavformat/rtsp.c