diff options
author | Stian Selnes <stian@pexip.com> | 2015-07-08 13:02:22 +0300 |
---|---|---|
committer | Tim-Philipp Müller <tim@centricular.com> | 2015-07-08 13:36:55 +0300 |
commit | 8a0dbff3f40ca6e84f8e04734090e5a6355ee351 (patch) | |
tree | 1ccd849a2dff453697308192b99b4a3e953f1648 | |
parent | ffe9cbc1f6866457e04976bfdbd05da0e87b7769 (diff) |
rtph263depay: Make sure payload is large enough
Plus new unit test.
https://bugzilla.gnome.org/show_bug.cgi?id=752112
-rw-r--r-- | gst/rtp/gstrtph263depay.c | 17 | ||||
-rw-r--r-- | tests/check/Makefile.am | 7 | ||||
-rw-r--r-- | tests/check/elements/rtph263.c | 116 |
3 files changed, 139 insertions, 1 deletions
diff --git a/gst/rtp/gstrtph263depay.c b/gst/rtp/gstrtph263depay.c index a63b0b13a..41b0fc4b0 100644 --- a/gst/rtp/gstrtph263depay.c +++ b/gst/rtp/gstrtph263depay.c @@ -234,6 +234,9 @@ gst_rtp_h263_depay_process (GstRTPBaseDepayload * depayload, GstBuffer * buf) M = gst_rtp_buffer_get_marker (&rtp); + if (payload_len < 1) + goto too_small; + /* Let's see what mode we are using */ F = (payload[0] & 0x80) == 0x80; P = (payload[0] & 0x40) == 0x40; @@ -255,6 +258,8 @@ gst_rtp_h263_depay_process (GstRTPBaseDepayload * depayload, GstBuffer * buf) * |F|P|SBIT |EBIT | SRC |I|U|S|A|R |DBQ| TRB | TR | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ + if (payload_len <= header_len) + goto too_small; I = (payload[1] & 0x10) == 0x10; } else { if (P == 0) { @@ -271,6 +276,8 @@ gst_rtp_h263_depay_process (GstRTPBaseDepayload * depayload, GstBuffer * buf) * |I|U|S|A| HMV1 | VMV1 | HMV2 | VMV2 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ + if (payload_len <= header_len) + goto too_small; I = (payload[4] & 0x80) == 0x80; } else { /* F == 1 and P == 1 @@ -288,6 +295,8 @@ gst_rtp_h263_depay_process (GstRTPBaseDepayload * depayload, GstBuffer * buf) * | RR |DBQ| TRB | TR | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ + if (payload_len <= header_len) + goto too_small; I = (payload[4] & 0x80) == 0x80; } } @@ -389,6 +398,14 @@ skip: gst_rtp_buffer_unmap (&rtp); return NULL; + +too_small: + { + GST_ELEMENT_WARNING (rtph263depay, STREAM, DECODE, + ("Packet payload was too small"), (NULL)); + gst_rtp_buffer_unmap (&rtp); + return NULL; + } } static GstStateChangeReturn diff --git a/tests/check/Makefile.am b/tests/check/Makefile.am index a64f285ab..29ad9bc06 100644 --- a/tests/check/Makefile.am +++ b/tests/check/Makefile.am @@ -215,7 +215,9 @@ check_replaygain = endif if USE_PLUGIN_RTP -check_rtp = elements/rtp-payloading +check_rtp = \ + elements/rtp-payloading \ + elements/rtph263 else check_rtp = endif @@ -522,6 +524,9 @@ elements_rtpbin_buffer_list_LDADD = $(GST_PLUGINS_BASE_LIBS) \ $(GST_BASE_LIBS) $(GST_LIBS) $(GST_CHECK_LIBS) $(LDADD) elements_rtpbin_buffer_list_SOURCES = elements/rtpbin_buffer_list.c +elements_rtph263_CFLAGS = $(GST_PLUGINS_BASE_CFLAGS) $(GST_BASE_CFLAGS) $(AM_CFLAGS) +elements_rtph263_LDADD = $(GST_PLUGINS_BASE_LIBS) -lgstrtp-$(GST_API_VERSION) $(GST_BASE_LIBS) $(LDADD) + elements_rtpmux_CFLAGS = $(GST_PLUGINS_BASE_CFLAGS) $(GST_BASE_CFLAGS) $(AM_CFLAGS) elements_rtpmux_LDADD = $(GST_PLUGINS_BASE_LIBS) -lgstrtp-$(GST_API_VERSION) $(GST_BASE_LIBS) $(LDADD) diff --git a/tests/check/elements/rtph263.c b/tests/check/elements/rtph263.c new file mode 100644 index 000000000..2c77ece33 --- /dev/null +++ b/tests/check/elements/rtph263.c @@ -0,0 +1,116 @@ +/* GStreamer + * + * Copyright (C) 2015 Pexip AS + * @author Stian Selnes <stian@pexip.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Library General Public + * License as published by the Free Software Foundation; either + * version 2 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Library General Public License for more details. + * + * You should have received a copy of the GNU Library General Public + * License along with this library; if not, write to the + * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, + * Boston, MA 02110-1301, USA. + */ + +#include <gst/check/check.h> +#include <gst/check/gstharness.h> +#include <gst/rtp/gstrtpbuffer.h> + +#define RTP_H263_CAPS_STR(p) \ + "application/x-rtp,media=video,encoding-name=H263,clock-rate=90000," \ + "payload=" G_STRINGIFY(p) + +static GstBuffer * +create_rtp_buffer (guint8 * data, gsize size, guint ts, gint seqnum) +{ + GstBuffer *buf = gst_rtp_buffer_new_copy_data (data, size); + GstRTPBuffer rtp = GST_RTP_BUFFER_INIT; + + GST_BUFFER_PTS (buf) = (ts) * (GST_SECOND / 30); + + gst_rtp_buffer_map (buf, GST_MAP_WRITE, &rtp); + gst_rtp_buffer_set_seq (&rtp, seqnum); + gst_rtp_buffer_unmap (&rtp); + + return buf; +} + +GST_START_TEST (test_h263depay_start_packet_too_small_mode_a) +{ + GstHarness *h = gst_harness_new ("rtph263depay"); + guint8 packet[] = { + 0x80, 0xa2, 0x17, 0x62, 0x57, 0xbb, 0x48, 0x98, 0x4a, 0x59, 0xe8, 0xdc, + 0x00, 0x00, 0x80, 0x00 + }; + + gst_harness_set_src_caps_str (h, RTP_H263_CAPS_STR (34)); + fail_unless_equals_int (GST_FLOW_OK, + gst_harness_push (h, create_rtp_buffer (packet, sizeof (packet), 0, 0))); + + /* Packet should be dropped and depayloader not crash */ + fail_unless_equals_int (0, gst_harness_buffers_received (h)); + + gst_harness_teardown (h); +} +GST_END_TEST; + +GST_START_TEST (test_h263depay_start_packet_too_small_mode_b) +{ + GstHarness *h = gst_harness_new ("rtph263depay"); + guint8 packet[] = { + 0x80, 0xa2, 0x17, 0x62, 0x57, 0xbb, 0x48, 0x98, 0x4a, 0x59, 0xe8, 0xdc, + 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + + gst_harness_set_src_caps_str (h, RTP_H263_CAPS_STR (34)); + fail_unless_equals_int (GST_FLOW_OK, + gst_harness_push (h, create_rtp_buffer (packet, sizeof (packet), 0, 0))); + + /* Packet should be dropped and depayloader not crash */ + fail_unless_equals_int (0, gst_harness_buffers_received (h)); + + gst_harness_teardown (h); +} +GST_END_TEST; + +GST_START_TEST (test_h263depay_start_packet_too_small_mode_c) +{ + GstHarness *h = gst_harness_new ("rtph263depay"); + guint8 packet[] = { + 0x80, 0xa2, 0x17, 0x62, 0x57, 0xbb, 0x48, 0x98, 0x4a, 0x59, 0xe8, 0xdc, + 0xc0, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + + gst_harness_set_src_caps_str (h, RTP_H263_CAPS_STR (34)); + fail_unless_equals_int (GST_FLOW_OK, + gst_harness_push (h, create_rtp_buffer (packet, sizeof (packet), 0, 0))); + + /* Packet should be dropped and depayloader not crash */ + fail_unless_equals_int (0, gst_harness_buffers_received (h)); + + gst_harness_teardown (h); +} +GST_END_TEST; + +static Suite * +rtph263_suite (void) +{ + Suite *s = suite_create ("rtph263"); + TCase *tc_chain; + + suite_add_tcase (s, (tc_chain = tcase_create ("h263depay"))); + tcase_add_test (tc_chain, test_h263depay_start_packet_too_small_mode_a); + tcase_add_test (tc_chain, test_h263depay_start_packet_too_small_mode_b); + tcase_add_test (tc_chain, test_h263depay_start_packet_too_small_mode_c); + + return s; +} + +GST_CHECK_MAIN (rtph263); |