diff options
| author | Samuel Pitoiset <samuel.pitoiset@gmail.com> | 2012-07-26 20:45:42 +0200 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2012-07-26 22:57:15 +0300 |
| commit | 8ea1459bc32b55441fb49311fcee4f9f0fcf39b9 (patch) | |
| tree | 04db8124f7962442004bdb19ec94b1d3cb3c276c /libavformat/rtmpproto.c | |
| parent | e49e6b645167df0e15781244a2e1e405abb04bf1 (diff) | |
rtmp: Check the buffer length of ping packets
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat/rtmpproto.c')
| -rw-r--r-- | libavformat/rtmpproto.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 4e5eddb69a..501e0eddc7 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -515,6 +515,12 @@ static int gen_pong(URLContext *s, RTMPContext *rt, RTMPPacket *ppkt) uint8_t *p; int ret; + if (ppkt->data_size < 6) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + ppkt->data_size); + return AVERROR_INVALIDDATA; + } + if ((ret = ff_rtmp_packet_create(&pkt, RTMP_NETWORK_CHANNEL, RTMP_PT_PING, ppkt->timestamp + 1, 6)) < 0) return ret; @@ -913,6 +919,12 @@ static int handle_ping(URLContext *s, RTMPPacket *pkt) RTMPContext *rt = s->priv_data; int t, ret; + if (pkt->data_size < 2) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + pkt->data_size); + return AVERROR_INVALIDDATA; + } + t = AV_RB16(pkt->data); if (t == 6) { if ((ret = gen_pong(s, rt, pkt)) < 0) |