diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 11:14:51 +0100 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2016-12-15 15:45:59 +0200 |
| commit | a4fec9a7eab842ea5eea1b1ee98624356cb31422 (patch) | |
| tree | 86ebc265fa54d54887e475a0cb1799a1340991b5 /libavformat/rtmppkt.c | |
| parent | cdcfa97dc49d83b5eefd0a651db6bb0a6f98e8f2 (diff) | |
rtmppkt: Check for packet size mismatches
When receiving fragmented packets, the first packet declares the size,
and the later ones normally are small follow-on packets that don't repeat
the size and the other header fields. But technically, the later fragments
also can have a full header, declaring a different size than the previous
packet.
If the follow-on packet declares a larger size than the initial one, we
could end up writing outside of the allocation.
This fixes out of bounds writes.
Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat/rtmppkt.c')
| -rw-r--r-- | libavformat/rtmppkt.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index f8c51d01fa..1cb3078679 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p, if (hdr != RTMP_PS_TWELVEBYTES) timestamp += prev_pkt[channel_id].timestamp; + if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) { + av_log(h, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n", + size, prev_pkt[channel_id].size); + ff_rtmp_packet_destroy(&prev_pkt[channel_id]); + prev_pkt[channel_id].read = 0; + return AVERROR_INVALIDDATA; + } + if (!prev_pkt[channel_id].read) { if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp, size)) < 0) |