[gnurl] 304/411: rtsp: fixed Session ID comparison to refuse prefix

[gnunet]

This is an automated email from the git hooks/post-receive script.

nikita pushed a commit to branch master
in repository gnurl.

commit adb0fcfab238ac6858ade3b9b5cc332fa0f60dfd
Author: Harry Sintonen <sintonen@iki.fi>
AuthorDate: Tue Nov 3 03:36:56 2020 +0200

    rtsp: fixed Session ID comparison to refuse prefix
    
    Closes #6161
---
 lib/rtsp.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/rtsp.c b/lib/rtsp.c
index 46c3c4f8f..93aac0f20 100644
--- a/lib/rtsp.c
+++ b/lib/rtsp.c
@@ -786,9 +786,18 @@ CURLcode Curl_rtsp_parseheader(struct connectdata *conn,
       failf(data, "Got a blank Session ID");
     }
     else if(data->set.str[STRING_RTSP_SESSION_ID]) {
+      char *end;
+      size_t idlen;
+
+      /* Find the end of Session ID */
+      end = start + 1;
+      while(*end && !ISSPACE(*end))
+        end++;
+      idlen = end - start;
+
       /* If the Session ID is set, then compare */
-      if(strncmp(start, data->set.str[STRING_RTSP_SESSION_ID],
-                 strlen(data->set.str[STRING_RTSP_SESSION_ID]))  != 0) {
+      if(strlen(data->set.str[STRING_RTSP_SESSION_ID]) != idlen ||
+         strncmp(start, data->set.str[STRING_RTSP_SESSION_ID], idlen) != 0) {
         failf(data, "Got RTSP Session ID Line [%s], but wanted ID [%s]",
               start, data->set.str[STRING_RTSP_SESSION_ID]);
         return CURLE_RTSP_SESSION_ERROR;

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.