<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
<div>Hi,</div><div><br></div><div>I use mplayer to visit rtsp://localhost:8854/mp3test, If RTSPServer recv the request , RTSPServer will call the function "handleRequestBytes",</div><div>In this function we see the local unsigned variable "contentLength", and this local variable is not init , thus the variable's init value is not sure is 0xffffffff,0xcccccccc,or other values.</div><div><br></div><div>then the first rtsp request is "rtsp://localhost:8854" and not contain "mp3test", this time the next function call "parseRTSPRequestString" will failed, and the var "contentLength" is not a sure value.</div><div><br></div><div> when continue to this setup "unsigned requestSize = (fLastCRLF+4-fRequestBuffer) + contentLength;" in function "handleRequestByte" , if "contentLength" is 0xffffffff then "requestSize" is the request buffer size - 1, if "contentLength" is 0xcccccccc the "requestSize" is a big num,or other posible value.</div><div><br></div><div>next setup " memmove(fRequestBuffer, &fRequestBuffer[requestSize], numBytesRemaining);" if requestSize is a big num , this call will crashed.</div> </div></body>
</html>