RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)
其他弱点 / Improper Check or Handling of Exceptional Conditions / #3575250
该报告还没有中文解读。
原文摘录
摘自原文（6799 字符中的一小部分）
I am submitting this as a security issue primarily due to how it was discovered and that it's my first Curl submission, but I suspect I might be overly cautious here.
原文中的代码
# 1. Clone oss-fuzz (or use existing checkout) git clone https://github.com/google/oss-fuzz.git cd oss-fuzz # 2. Build the curl fuzzers (requires Docker) python3 infra/helper.py build_fuzzers curl # 3. Replay against the attached payload python3 infra/helper.py reproduce curl curl_fuzzer_rtsp …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @davkor · 版权归作者与 curl 所有