modules/services_discovery/sap.c: avoid out-of-bounds write

After OpenDemux reads data using stream_Read(), it writes a '\0' to the buffer after the newly-read data, but if the stream returned exactly i_read_max bytes, this '\0' will end up just past the end of the allocated psz_sdp array (see the call to realloc at the beginning of the loop). Adjust the realloc call to allocate this one extra byte. Signed-off-by: Rémi Denis-Courmont <[email protected]>
kylinhaha · Jan 17, 2013 · dee9287 · dee9287
1 parent 301c200
commit dee9287
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/services_discovery/sap.c b/modules/services_discovery/sap.c
@@ -351,7 +351,7 @@ static int OpenDemux( vlc_object_t *p_this )
     for( i_len = 0, psz_sdp = NULL; i_len < 65536; )
     {
         const int i_read_max = 1024;
-        char *psz_sdp_new = realloc( psz_sdp, i_len + i_read_max );
+        char *psz_sdp_new = realloc( psz_sdp, i_len + i_read_max + 1 );
         size_t i_read;
         if( psz_sdp_new == NULL )
         {