diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-21 14:55:48 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-21 14:55:48 +0100 |
| commit | acc0c0190bd6144d921397d53e928532a8d86de0 (patch) | |
| tree | f7296da32f37597be3fd11bd4ac9fddf6037743a /libavformat/srtp.c | |
| parent | fbdb0313f53f84f5a8a5a23ad1880bf7ef4dcc5f (diff) | |
| parent | f53490cc0c809975f8238d5a9edbd26f83bd2f84 (diff) | |
| download | ffmpeg-acc0c0190bd6144d921397d53e928532a8d86de0.tar.gz | |
Merge commit 'f53490cc0c809975f8238d5a9edbd26f83bd2f84'
* commit 'f53490cc0c809975f8238d5a9edbd26f83bd2f84':
rtpdec/srtp: Handle CSRC fields being present
rtpdec: Check the return value from av_new_packet
ac3dec: fix non-optimal dithering of zero bit mantissas
Conflicts:
libavcodec/ac3dec.c
libavformat/rtpdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/srtp.c')
| -rw-r--r-- | libavformat/srtp.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavformat/srtp.c b/libavformat/srtp.c index 7d344b816d..993a3b6a4a 100644 --- a/libavformat/srtp.c +++ b/libavformat/srtp.c @@ -190,16 +190,23 @@ int ff_srtp_decrypt(struct SRTPContext *s, uint8_t *buf, int *lenptr) if (!(srtcp_index & 0x80000000)) return 0; } else { + int csrc; s->seq_initialized = 1; s->seq_largest = seq_largest; s->roc = roc; + csrc = buf[0] & 0x0f; ext = buf[0] & 0x10; ssrc = AV_RB32(buf + 8); buf += 12; len -= 12; + buf += 4 * csrc; + len -= 4 * csrc; + if (len < 0) + return AVERROR_INVALIDDATA; + if (ext) { if (len < 4) return AVERROR_INVALIDDATA; @@ -244,7 +251,7 @@ int ff_srtp_encrypt(struct SRTPContext *s, const uint8_t *in, int len, buf += 8; len -= 8; } else { - int ext; + int ext, csrc; int seq = AV_RB16(buf + 2); ssrc = AV_RB32(buf + 8); @@ -253,11 +260,17 @@ int ff_srtp_encrypt(struct SRTPContext *s, const uint8_t *in, int len, s->seq_largest = seq; index = seq + (((uint64_t)s->roc) << 16); + csrc = buf[0] & 0x0f; ext = buf[0] & 0x10; buf += 12; len -= 12; + buf += 4 * csrc; + len -= 4 * csrc; + if (len < 0) + return AVERROR_INVALIDDATA; + if (ext) { if (len < 4) return AVERROR_INVALIDDATA; |