rtpdec/srtp: Handle CSRC fields being present

This is untested in practice, but follows the spec.

Signed-off-by: Martin Storsjö <martin@martin.st>

1 files changed, 7 insertions, 3 deletions

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index a8188878eb..145d7c82e9 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -575,11 +575,12 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt,
 {
     unsigned int ssrc;
     int payload_type, seq, flags = 0;
-    int ext;
+    int ext, csrc;
     AVStream *st;
     uint32_t timestamp;
     int rv = 0;
 
+    csrc         = buf[0] & 0x0f;
     ext          = buf[0] & 0x10;
     payload_type = buf[1] & 0x7f;
     if (buf[1] & 0x80)
@@ -613,6 +614,11 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt,
     len   -= 12;
     buf   += 12;
 
+    len   -= 4 * csrc;
+    buf   += 4 * csrc;
+    if (len < 0)
+        return AVERROR_INVALIDDATA;
+
     /* RFC 3550 Section 5.3.1 RTP Header Extension handling */
     if (ext) {
         if (len < 4)
@@ -633,8 +639,6 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt,
                                       s->st, pkt, &timestamp, buf, len, seq,
                                       flags);
     } else if (st) {
-        /* At this point, the RTP header has been stripped;
-         * This is ASSUMING that there is only 1 CSRC, which isn't wise. */
         if ((rv = av_new_packet(pkt, len)) < 0)
             return rv;
         memcpy(pkt->data, buf, len);