rtmp: Return an error when the client bandwidth is incorrect

Signed-off-by: Martin Storsjö <martin@martin.st>

1 files changed, 10 insertions, 2 deletions

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 5ac60d21a0..a2efe3882f 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -932,8 +932,16 @@ static int handle_client_bw(URLContext *s, RTMPPacket *pkt)
                pkt->data_size);
         return AVERROR_INVALIDDATA;
     }
-    av_log(s, AV_LOG_DEBUG, "Client bandwidth = %d\n", AV_RB32(pkt->data));
-    rt->client_report_size = AV_RB32(pkt->data) >> 1;
+
+    rt->client_report_size = AV_RB32(pkt->data);
+    if (rt->client_report_size <= 0) {
+        av_log(s, AV_LOG_ERROR, "Incorrect client bandwidth %d\n",
+                rt->client_report_size);
+        return AVERROR_INVALIDDATA;
+
+    }
+    av_log(s, AV_LOG_DEBUG, "Client bandwidth = %d\n", rt->client_report_size);
+    rt->client_report_size >>= 1;
 
     return 0;
 }