diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 11:14:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-23 13:15:16 +0200 |
| commit | 4c5ebe4b014a208b8c8f52d61c4fb42b98d60e67 (patch) | |
| tree | acea9595e98600721968a96f4e9dd905838cddc0 | |
| parent | cdea949fcf1471afa2da0b4806c3ba8ee9c16694 (diff) | |
| download | ffmpeg-4c5ebe4b014a208b8c8f52d61c4fb42b98d60e67.tar.gz | |
avformat/rtmppkt: Check for packet size mismatches
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d57ca4d9a75562fa32e40766211de150f8b3ee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/rtmppkt.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index 92172dc366..3a82900f10 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p, if (hdr != RTMP_PS_TWELVEBYTES) timestamp += prev_pkt[channel_id].timestamp; + if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) { + av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n", + size, + prev_pkt[channel_id].size); + ff_rtmp_packet_destroy(&prev_pkt[channel_id]); + prev_pkt[channel_id].read = 0; + } + if (!prev_pkt[channel_id].read) { if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp, size)) < 0) |