Skip to content

rtsp-auth: Fix NULL pointer dereference when handling an invalid basic Authorization header

Sebastian Dröge requested to merge slomo/gst-rtsp-server:rtsp-auth-basic-crash into master

When using the basic authentication scheme, we wouldn't validate that the authorization field of the credentials is not NULL and pass it on to g_hash_table_lookup(). g_str_hash() however is not NULL-safe and will dereference the NULL pointer and crash. A specially crafted (read: invalid) RTSP header can cause this to happen.

As a solution, check for the authorization to be not NULL before continuing processing it and if it is simply fail authentication.

This fixes CVE-2020-6095 and TALOS-2020-1018.

Discovered by Peter Wang of Cisco ASIG.

Merge request reports