fix: bound sprop-parameter-sets copy to prevent SDP stack overflow

SessionDescriptor::generateFormatContext() copied the camera-controlled
SDP sprop-parameter-sets value into a fixed char pvalue[1024] stack
buffer with an unbounded strcpy(), so a malicious or MitM'd RTSP camera
returning an oversized sprop-parameter-sets in its DESCRIBE response
could overflow the stack (saved frame pointer / return address) for RCE
as the capture process user.

A real H.264 SPS/PPS base64 blob is small; refuse anything that would
not fit the buffer instead of copying it. The existing inner base64
parse loop was already bounded, so only this outer copy was unsafe.

Refs GHSA-wg5h-vcgv-74pv.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: connortechnology

src/zm_sdp.cpp

@@ -367,7 +367,17 @@ AVFormatContext *SessionDescriptor::generateFormatContext() const {
       codec_context->extradata= nullptr;
       char pvalue[1024], *value = pvalue;
 
-      strcpy(pvalue, mediaDesc->getSprops().c_str());
+      // sprop-parameter-sets comes from the (untrusted) camera SDP. A real
+      // H.264 SPS/PPS base64 blob is small; anything approaching the buffer
+      // size is malformed or hostile, so refuse it rather than overflow the
+      // stack with an unbounded strcpy.
+      if (mediaDesc->getSprops().size() >= sizeof(pvalue)) {
+        Warning("Ignoring oversized sprop-parameter-sets (%zu bytes) from SDP",
+                mediaDesc->getSprops().size());
+        pvalue[0] = '\0';
+      } else {
+        strcpy(pvalue, mediaDesc->getSprops().c_str());
+      }
 
       while ( *value ) {
         char base64packet[1024];