Multiple memory issues in rtsp server

[Arslan8]

Board: STM32F769I_EVAL
Compiler: arm-none-eabi-gcc v13

Describe the bug
A buffer overflow occurs in the RTSP server response construction. The server builds responses using repeated sprintf, strcat, and strlen appends without tracking the destination buffer's capacity. Additionally, the unsupported Require-header path copies unbounded request data until a Carriage Return (CR) character is encountered.

How To Reproduce

1. Indicate the global behavior of your application project:
   RTSP Streaming Server via LwIP.

2. The modules that you suspect to be the cause of the problem (Driver, BSP, MW ...):
   Middleware/Application: LwIP_StreamingServer
   File: Projects/STM32F769I_EVAL/Applications/LwIP/LwIP_StreamingServer/Src/rtsp_protocol.c

3. The use case that generates the problem:
   Receiving a remote RTSP request containing a highly expanded header field, specifically an overly long Require value.

4. How we can reproduce the problem:

   • Send an RTSP request to the server with a long Require value that does not contain implicit-play, or include other fields that expand the response construction.
   • The vulnerable code appends each character to response + strlen(response) until a CRLF sequence is reached, performing no checks against the remaining buffer capacity.

Additional context

• Impact: A remote RTSP client can force response generation to exceed the allocated response buffer, causing memory corruption in the streaming-server process/task.
• Affected Revision: STM32CubeF7 revision c2ecfd2d
• Proposed Fix:
  1. Pass the buffer length to each response helper function and utilize bounded append primitives (e.g., snprintf, strncat).
  2. Implement checks to stop parsing and reject the request if the response exceeds the buffer capacity.
  3. Correct the erroneous memset(response, 0, sizeof(&response)) call, which currently clears only pointer-sized bytes rather than the full buffer when response is passed as a pointer.

[ASAHSTM]

Hello @Arslan8,

Thank you for the report.
To continue the analysis, could you please share the exact RTSP request used to trigger the behavior, including the full Require header value if possible?
It would also be helpful to know the approximate size of the request and, if available, provide a network trace or server log excerpt.
These details will help us reproduce the scenario and assess the observed behavior.

With Regards,