rtsp: Don't pass string pointer as format string to ff_url_join
authorMartin Storsjö <martin@martin.st>
Thu, 16 Jun 2011 08:04:27 +0000 (11:04 +0300)
committerMartin Storsjö <martin@martin.st>
Thu, 16 Jun 2011 14:40:28 +0000 (17:40 +0300)
In this case, the string that was passed couldn't contain
user-defined data and thus there was no risk for injection
bugs, but it's safer this way, if we later change the
content of the options string.

Signed-off-by: Martin Storsjö <martin@martin.st>
libavformat/rtsp.c

index b2735f6165da51cac6f63fd146f0286a1db478ae..eeea9be4a0dc9b41a583bedb7812823bea07b2b4 100644 (file)
@@ -1234,10 +1234,10 @@ int ff_rtsp_make_setup_request(AVFormatContext *s, const char *host, int port,
             if (reply->transports[0].source[0]) {
                 ff_url_join(url, sizeof(url), "rtp", NULL,
                             reply->transports[0].source,
-                            reply->transports[0].server_port_min, options);
+                            reply->transports[0].server_port_min, "%s", options);
             } else {
                 ff_url_join(url, sizeof(url), "rtp", NULL, host,
-                            reply->transports[0].server_port_min, options);
+                            reply->transports[0].server_port_min, "%s", options);
             }
             if (!(rt->server_type == RTSP_SERVER_WMS && i > 1) &&
                 rtp_set_remote_url(rtsp_st->rtp_handle, url) < 0) {