diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 13:14:51 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-06 02:07:50 +0300 |
| commit | 32b95471a86ae383c0f76361d954aec511f7043a (patch) | |
| tree | d97a06c9258c878f888bbb427fc0ec2c98e76336 /libavformat | |
| parent | f66bfe71bbca014f449a8e9771bc790c6295da28 (diff) | |
avformat/rtmppkt: Check for packet size mismatches
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d57ca4d9a75562fa32e40766211de150f8b3ee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtmppkt.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index 0d693c27f7..cde0da78ce 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p, if (hdr != RTMP_PS_TWELVEBYTES) timestamp += prev_pkt[channel_id].timestamp; + if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) { + av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n", + size, + prev_pkt[channel_id].size); + ff_rtmp_packet_destroy(&prev_pkt[channel_id]); + prev_pkt[channel_id].read = 0; + } + if (!prev_pkt[channel_id].read) { if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp, size)) < 0) |