diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 11:14:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 21:37:48 +0100 |
| commit | b0ebef0578fd88fe3efd66086c43a5b43fbc9f6a (patch) | |
| tree | ed59f37db3b7bd2f797475b3243dc6a30f6da653 | |
| parent | 540a4433bd35fda61562e04a2a2aa3fa358c5a24 (diff) | |
| download | ffmpeg-b0ebef0578fd88fe3efd66086c43a5b43fbc9f6a.tar.gz | |
avformat/rtmppkt: Check for packet size mismatches
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d57ca4d9a75562fa32e40766211de150f8b3ee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/rtmppkt.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index 0d693c27f7..cde0da78ce 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p, if (hdr != RTMP_PS_TWELVEBYTES) timestamp += prev_pkt[channel_id].timestamp; + if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) { + av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n", + size, + prev_pkt[channel_id].size); + ff_rtmp_packet_destroy(&prev_pkt[channel_id]); + prev_pkt[channel_id].read = 0; + } + if (!prev_pkt[channel_id].read) { if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp, size)) < 0) |