Bug 92568

Summary:	[module-rtp-recv] non null terminated string / non portable sscanf
Product:	PulseAudio	Reporter:	Lev Melnikovsky <melnikovsky>
Component:	modules	Assignee:	pulseaudio-bugs
Status:	RESOLVED FIXED	QA Contact:	pulseaudio-bugs
Severity:	normal
Priority:	medium	CC:	lennart, melnikovsky
Version:	unspecified
Hardware:	All
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:
Attachments:	patch against pa5.0

Description Lev Melnikovsky 2015-10-21 13:49:21 UTC

Created attachment 119030 [details]
patch against pa5.0

In rtp.c:

if (sscanf(t+9, "%i %64c", &_payload, c) == 2)

the string c seems to be non-null terminated. It is later used as following:

c[strcspn(c, "\n")] = 0;

The same piece of code is responsible for the inability of pulseaudio on OpenWRT to handle RTP stream at the rate 48000 from another machine:

[pulseaudio] sdp.c: Failed to parse SDP data: missing data.

It turns out that uClibc does not agree with glibc about "%64c", see http://git.uclibc.org/uClibc/tree/docs/Glibc_vs_uClibc_Differences.txt

Attached is a patch that should take care of both issues.

Comment 1 Tanu Kaskinen 2015-11-04 10:46:12 UTC

Thanks a lot! I applied the patch now.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.