[FFmpeg-cvslog] avformat/rtsp: Check number of streams in sdp_parse_line()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri Jan 25 21:30:04 2019 +0100| [497c9b0cce559d43607bbbd679fe42f1d7e9040e] | committer: Michael Niedermayer

avformat/rtsp: Check number of streams in sdp_parse_line()

Fixes: OOM

Found-by: Michael Hanselmann <public at hansmi.ch>
Reviewed-by: Michael Hanselmann <public at hansmi.ch>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=497c9b0cce559d43607bbbd679fe42f1d7e9040e
---

 libavformat/rtsp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index 82c6c12af5..975637cf54 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -454,7 +454,10 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1,
         } else if (!strcmp(st_type, "text")) {
             codec_type = AVMEDIA_TYPE_SUBTITLE;
         }
-        if (codec_type == AVMEDIA_TYPE_UNKNOWN || !(rt->media_type_mask & (1 << codec_type))) {
+        if (codec_type == AVMEDIA_TYPE_UNKNOWN ||
+            !(rt->media_type_mask & (1 << codec_type)) ||
+            rt->nb_rtsp_streams >= s->max_streams
+        ) {
             s1->skip_media = 1;
             return;
         }