search

hfujita / pulseaudio-raop2

Experimental RAOP2 (Apple AirPlay2) support for PulseAudio
http://hfujita.github.io/pulseaudio-raop2/
Other
138 stars 19 forks source link

rtsp_auth_cb does out-of-bound accesses #37

Closed hfujita closed 9 years ago

hfujita commented 9 years ago

rtsp_auth_cb makes an out-of-bound memory access upon calling pa_raop_base64_encode.

uint16_t rac;
...
pa_raop_base64_encode(&rac, 8 * sizeof(rac), &sac);

rac has only 2 bytes but the second parameter (len) is 16 bytes, which causes an out-of-bound access.

This is a part of issues reported by Alexander. http://lists.freedesktop.org/archives/pulseaudio-discuss/2015-January/023003.html