diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-07-27 23:42:19 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-07-27 23:42:19 +0200 |
| commit | c6963a220d5849fd5399c056b21ec66de7a0df37 (patch) | |
| tree | 142ce617e997fd542f0f2ccd460212b5a3dc6835 /libavformat | |
| parent | 94c3e11a6f62bf13a7e6f1b9287c6112bf6ee445 (diff) | |
| parent | 5361e10a5e8740146c09a115477310c77b927215 (diff) | |
| download | ffmpeg-c6963a220d5849fd5399c056b21ec66de7a0df37.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
proresdsp: port x86 assembly to cpuflags.
lavr: x86: improve non-SSE4 version of S16_TO_S32_SX macro
lavfi: better channel layout negotiation
alac: check for truncated packets
alac: reverse lpc coeff order, simplify filter
lavr: add x86-optimized mixing functions
x86: add support for fmaddps fma4 instruction with abstraction to avx/sse
tscc2: fix typo in array index
build: use COMPILE template for HOSTOBJS
build: do full flag handling for all compiler-type tools
eval: fix printing of NaN in eval fate test.
build: Rename aandct component to more descriptive aandcttables
mpegaudio: bury inline asm under HAVE_INLINE_ASM.
x86inc: automatically insert vzeroupper for YMM functions.
rtmp: Check the buffer length of ping packets
rtmp: Allow having more unknown data at the end of a chunk size packet without failing
rtmp: Prevent reading outside of an allocate buffer when receiving server bandwidth packets
Conflicts:
Makefile
configure
libavcodec/x86/proresdsp.asm
libavutil/eval.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtmpproto.c | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 31a8639215..f68b7e65a1 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -515,6 +515,12 @@ static int gen_pong(URLContext *s, RTMPContext *rt, RTMPPacket *ppkt) uint8_t *p; int ret; + if (ppkt->data_size < 6) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + ppkt->data_size); + return AVERROR_INVALIDDATA; + } + if ((ret = ff_rtmp_packet_create(&pkt, RTMP_NETWORK_CHANNEL, RTMP_PT_PING, ppkt->timestamp + 1, 6)) < 0) return ret; @@ -885,9 +891,9 @@ static int handle_chunk_size(URLContext *s, RTMPPacket *pkt) RTMPContext *rt = s->priv_data; int ret; - if (pkt->data_size != 4) { + if (pkt->data_size < 4) { av_log(s, AV_LOG_ERROR, - "Chunk size change packet is not 4 bytes long (%d)\n", + "Too short chunk size change packet (%d)\n", pkt->data_size); return AVERROR_INVALIDDATA; } @@ -913,6 +919,12 @@ static int handle_ping(URLContext *s, RTMPPacket *pkt) RTMPContext *rt = s->priv_data; int t, ret; + if (pkt->data_size < 2) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + pkt->data_size); + return AVERROR_INVALIDDATA; + } + t = AV_RB16(pkt->data); if (t == 6) { if ((ret = gen_pong(s, rt, pkt)) < 0) @@ -950,6 +962,13 @@ static int handle_server_bw(URLContext *s, RTMPPacket *pkt) { RTMPContext *rt = s->priv_data; + if (pkt->data_size < 4) { + av_log(s, AV_LOG_ERROR, + "Too short server bandwidth report packet (%d)\n", + pkt->data_size); + return AVERROR_INVALIDDATA; + } + rt->server_bw = AV_RB32(pkt->data); if (rt->server_bw <= 0) { av_log(s, AV_LOG_ERROR, "Incorrect server bandwidth %d\n", |