Skip to content

Commit

Permalink
RtspThread: Fix a stack-buffer-overflow reported by ASAN
Browse files Browse the repository at this point in the history
==8109==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fab9b156480 at pc 0x7fabaebef57b bp 0x7fab9b154640 sp 0x7fab9b153df0
READ of size 32 at 0x7fab9b156480 thread T2
    #0 0x7fabaebef57a  (/lib/x86_64-linux-gnu/libasan.so.5+0xb857a)
    #1 0x561c0a9e24eb in bool std::__equal<true>::equal<char>(char const*, char const*, char const*) /usr/include/c++/8/bits/stl_algobase.h:814
    #2 0x561c0a9dfa8e in bool std::__equal_aux<char*, char*>(char*, char*, char*) /usr/include/c++/8/bits/stl_algobase.h:831
    #3 0x561c0a9dd982 in bool std::equal<__gnu_cxx::__normal_iterator<char*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >
, __gnu_cxx::__normal_iterator<char*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >(__gnu_cxx::__normal_iterator<char*,
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, std::__cxx11::basic_string<char, std::c
har_traits<char>, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>
> >) /usr/include/c++/8/bits/stl_algobase.h:1049
    #4 0x561c0a9cf75a in RtspThread::Run() /root/zoneminder/src/zm_rtsp.cpp:411
    #5 0x561c0a9df6e9 in void std::__invoke_impl<void, void (RtspThread::*)(), RtspThread*>(std::__invoke_memfun_deref, void (RtspThread::*&&)(), RtspThread*&
&) /usr/include/c++/8/bits/invoke.h:73
    #6 0x561c0a9dd4ae in std::__invoke_result<void (RtspThread::*)(), RtspThread*>::type std::__invoke<void (RtspThread::*)(), RtspThread*>(void (RtspThread::
*&&)(), RtspThread*&&) (/root/zoneminder/cmake-build-debug-remote/src/zmc+0x1544ae)
    #7 0x561c0a9e6a1a in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)())) std::thread::_Invoker<std::tuple<void (RtspThread::*)(), RtspThread*> >
::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/8/thread:244
    #8 0x561c0a9e698d in std::thread::_Invoker<std::tuple<void (RtspThread::*)(), RtspThread*> >::operator()() /usr/include/c++/8/thread:253
    #9 0x561c0a9e68ff in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (RtspThread::*)(), RtspThread*> > >::_M_run() /usr/include/c++/8/threa
d:196
    #10 0x7fabaca57b2e  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xbbb2e)
    #11 0x7fabae50dfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
    #12 0x7fabac7354ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)
  • Loading branch information
Carbenium committed Apr 11, 2021
1 parent 8799a33 commit 0203e74
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/zm_rtsp.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -408,7 +408,7 @@ void RtspThread::Run() {
{
// Check if control Url is absolute or relative
controlUrl = mediaDesc->getControlUrl();
if ( std::equal(trackUrl.begin(), trackUrl.end(), controlUrl.begin()) ) {
if (trackUrl == controlUrl) {
trackUrl = controlUrl;
} else {
if ( *trackUrl.rbegin() != '/' ) {
Expand Down

0 comments on commit 0203e74

Please sign in to comment.