 TristanInSec
|
476677b0f0
|
Fix OOB reads and infinite loop in TLV and DMAP parsers
pair_ap/pair-tlv.c (pair_tlv_parse):
- Add bounds check before reading type and length bytes (i + 2 > length)
- Fix off-by-one in chunked TLV scan loop (j + 1 < length)
- Add bounds checks inside data copy loop to prevent OOB memcpy
- Add else branch to advance index when size == 0 (prevents infinite loop)
rtsp.c (handle_set_parameter_metadata):
- Require 8 bytes remaining for tag + length fields (off + 8 <= cl)
- Validate value length against remaining buffer before read
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
|
2026-06-16 10:33:18 -04:00 |
|
Mike Brady