summaryrefslogtreecommitdiff
path: root/libavformat/rtmppkt.c
Commit message (Collapse)AuthorAge
* Merge commit 'a4fec9a7eab842ea5eea1b1ee98624356cb31422'Clément Bœsch2017-04-26
|\ | | | | | | | | | | | | | | | | * commit 'a4fec9a7eab842ea5eea1b1ee98624356cb31422': rtmppkt: Check for packet size mismatches See 7d57ca4d9a75562fa32e40766211de150f8b3ee7 Merged-by: Clément Bœsch <u@pkh.me>
| * rtmppkt: Check for packet size mismatchesMichael Niedermayer2016-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When receiving fragmented packets, the first packet declares the size, and the later ones normally are small follow-on packets that don't repeat the size and the other header fields. But technically, the later fragments also can have a full header, declaring a different size than the previous packet. If the follow-on packet declares a larger size than the initial one, we could end up writing outside of the allocation. This fixes out of bounds writes. Found-by: Paul Cher <paulcher@icloud.com> Reviewed-by: Paul Cher <paulcher@icloud.com> CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
* | avformat/rtmppkt: Check for packet size mismatchesMichael Niedermayer2016-12-05
| | | | | | | | | | | | | | | | Fixes out of array access Found-by: Paul Cher <paulcher@icloud.com> Reviewed-by: Paul Cher <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | rtmp: support the AMF_DATE tagAndrew Stone2015-09-01
| | | | | | | | | | | | | | | | Instead of returning EINVAL, which can cause a stream to fail to load, this allows the tag to be passed through to the flv demuxer, where it's summarily ignored. Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Merge commit '024e5a2d5ff8a94adce48abb15ce2fb471f9d18e'Michael Niedermayer2015-01-15
|\| | | | | | | | | | | | | * commit '024e5a2d5ff8a94adce48abb15ce2fb471f9d18e': rtmppkt: Repeat the full 32 bit timestamp for chunking continuation packets Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Repeat the full 32 bit timestamp for chunking continuation packetsMartin Storsjö2015-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes sending chunked packets (packets larger than the output chunk size, which often can be e.g. 4096 bytes) with a timestamp delta (or absolute timstamp, if it's a timestamp step backwards, or the first packet of the stream) larger than 0xffffffff. The RTMP spec explicitly says (in section 5.3.1.3.) that packets of type 3 (continuation packets) should include this field, if the previous non-continuation packet had it included. The receiving code handles these packets correctly. Pointed out by Cheolho Park. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '44127b157e9f8acb837d4bb3a094f56b40da3ef5'Michael Niedermayer2014-11-28
|\| | | | | | | | | | | | | * commit '44127b157e9f8acb837d4bb3a094f56b40da3ef5': rtmppkt: Make pkt->data reallocable Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Make pkt->data reallocableMartin Storsjö2014-11-28
| | | | | | | | | | | | | | | | We try to avoid mixing av_malloc with av_realloc, since av_malloc may be implemented with functions that can't (formally) be mixed with the functions used in av_realloc. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '3b18857ab301d2a0b3e86e9d85eed76f0798a29c'Michael Niedermayer2014-06-01
|\| | | | | | | | | | | | | * commit '3b18857ab301d2a0b3e86e9d85eed76f0798a29c': rtmppkt: Add method to read an AMF string that is not prefixed by its type Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Add method to read an AMF string that is not prefixed by its typeUwe L. Korn2014-06-01
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | avformat/rtmppkt: Fix random crashkyh964032014-04-23
| | | | | | | | | | | | Fixes Ticket3564 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * qatar/master: rtmppkt: Rename the ts_delta field to ts_field Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Rename the ts_delta field to ts_fieldMartin Storsjö2014-03-07
| | | | | | | | | | | | | | | | | | | | | | Based on a suggestion by Martin Panter. This is more descriptive, since it's the actual timestamp field from the RTMP packet, which might or might not be a delta depending on context (in some packets it's a delta, in some packets it's an absolute timestamp, and in some packets it's 0xffffff to indicate that the actual delta or absolute timestamp is transmitted separately). Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '8bbb02ae4f44f1cddc1ce1e74a71fa2022e93da3'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '8bbb02ae4f44f1cddc1ce1e74a71fa2022e93da3': rtmppkt: Properly handle extended timestamps when writing Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Properly handle extended timestamps when writingMartin Panter2014-03-07
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '48cfb5f4114048383a4ee85b2f500eefce24cad2'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '48cfb5f4114048383a4ee85b2f500eefce24cad2': rtmppkt: Add a descriptive comment Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Add a descriptive commentMartin Panter2014-03-07
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '5b2ad78f97d43299adcb038c04346999fe9b196c'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '5b2ad78f97d43299adcb038c04346999fe9b196c': rtmppkt: Handle extended timestamp field even for one-byte header Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Handle extended timestamp field even for one-byte headerMartin Panter2014-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Related fix in "rtmpdump": https://repo.or.cz/w/rtmpdump.git/commitdiff/79459a2 Adobe's RTMP specification (21 Dec 2012), section 5.3.1.3 ("Extended Timestamp"), says "this field is present in Type 3 chunks". Type 3 chunks are those with the one-byte header size. This resolves intermittent hangs and segfaults caused by the read function, and also includes an untested fix for the write function. The read function was tested with ABC (Australia) News 24 streams, however they are probably restricted to only Australian internet addresses. Some of the packets at the start of these streams seem to contain junk timestamp fields, often requiring the extended field. Test command: avplay rtmp://cp81899.live.edgefcs.net/live/news24-med@28772 Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '89564be444d24f75ea5add8b6987e414cf7aa7d5'Michael Niedermayer2014-01-21
|\| | | | | | | | | | | | | * commit '89564be444d24f75ea5add8b6987e414cf7aa7d5': rtmpproto: Send a full, absolute timestamp if it isn't monotonically growing Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmpproto: Send a full, absolute timestamp if it isn't monotonically growingMartin Storsjö2014-01-20
| | | | | | | | | | | | | | | | The normal differential timestamps can't handle negative differences, thus send a full packet header with an absolute timestamp in these cases. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '84a125c4c28f3e3e215d2e6c32f7f0ec43bbc04c'Michael Niedermayer2013-10-14
|\| | | | | | | | | | | | | * commit '84a125c4c28f3e3e215d2e6c32f7f0ec43bbc04c': rtmp: Allocate the prev_pkt arrays dynamically Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Allocate the prev_pkt arrays dynamicallyMartin Storsjö2013-10-14
| | | | | | | | | | | | | | | | | | | | Normally, all channel ids are between 0 and 10, while they in uncommon cases can have values up to 64k. This avoids allocating two arrays for up to 64k entries (at a total of over 6 MB in size) each when most of them aren't used at all. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '32a414f316c7f0eea877370e3f9d9f25afbf5da2'Michael Niedermayer2013-09-23
|\| | | | | | | | | | | | | * commit '32a414f316c7f0eea877370e3f9d9f25afbf5da2': rtmp: Support AMF_DATA_TYPE_MIXEDARRAY Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Support AMF_DATA_TYPE_MIXEDARRAYLuca Barbato2013-09-22
| | | | | | | | | | | | | | | | | | And fix the AMF_DATA_TYPE_ARRAY parsing while at it. A MIXEDARRAY type, as the ARRAY, store the number of elements in an uint32 before the list. The ARRAY is strict and does not have an OBJECT terminator, MIXEDARRAY behaves like an OBJECT type and a different than stated number of element can be present.
* | Merge commit '8583b14252deac71136f1dec231910abab0ba503'Michael Niedermayer2013-09-18
|\| | | | | | | | | | | | | * commit '8583b14252deac71136f1dec231910abab0ba503': rtmp: Support reading interleaved chunks. Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Support reading interleaved chunks.Josh Allmann2013-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A given packet won't always come in contiguously; sometimes they may be broken up on chunk boundaries by packets of another channel. This support primarily involves tracking information about the data that's been read, so the reader can pick up where it left off for a given channel. As a side effect, we no longer over-report the bytes read if (toread = MIN(size, chunk_size)) == size Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2013-08-11
|\| | | | | | | | | | | | | * qatar/master: rtmp: Do not misuse memcmp Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Do not misuse memcmpLuca Barbato2013-08-11
| | | | | | | | CC: libav-stable@libav.org
* | Merge commit 'ba5393a609c723ec8ab7f9727c10fef734c09278'Michael Niedermayer2013-08-11
|\| | | | | | | | | | | | | * commit 'ba5393a609c723ec8ab7f9727c10fef734c09278': rtmp: rename data_size to size Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: rename data_size to sizeLuca Barbato2013-08-10
| |
* | Merge commit '28306e6d620c109ddd672f7243adfbc2bbb3b18f'Michael Niedermayer2013-06-02
|\| | | | | | | | | | | | | | | | | | | | | * commit '28306e6d620c109ddd672f7243adfbc2bbb3b18f': network: factor out bind-listening code use my full first name instead of short one in copyrights Conflicts: libavformat/tcp.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * use my full first name instead of short one in copyrightsKostya Shishkov2013-06-01
| |
* | Merge commit 'e926b5ceb1962833f0c884a328382bc2eca67aff'Michael Niedermayer2013-05-01
|\| | | | | | | | | | | | | | | | | | | | | | | * commit 'e926b5ceb1962833f0c884a328382bc2eca67aff': avformat: Drop unnecessary ff_ name prefixes from static functions Conflicts: libavformat/audiointerleave.c libavformat/mux.c libavformat/mxfenc.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * avformat: Drop unnecessary ff_ name prefixes from static functionsDiego Biurrun2013-04-30
| |
| * rtmp: fix buffer overflows in ff_amf_tag_contents()Xi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A negative `size' will bypass FFMIN(). In the subsequent memcpy() call, `size' will be considered as a large positive value, leading to a buffer overflow. Change the type of `size' to unsigned int to avoid buffer overflow, and simplify overflow checks accordingly. Also change a literal buffer size to use sizeof, and limit the amount of data copied in another memcpy call as well. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Martin Storsjö <martin@martin.st>
| * rtmp: fix multiple broken overflow checksXi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | Sanity checks like `data + size >= data_end || data + size < data' are broken, because `data + size < data' assumes pointer overflow, which is undefined behavior in C. Many compilers such as gcc/clang optimize such checks away. Use `size < 0 || size >= data_end - data' instead. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Martin Storsjö <martin@martin.st>
* | rtmp: fix buffer overflows in ff_amf_tag_contents()Xi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | A negative `size' will bypass FFMIN(). In the subsequent memcpy() call, `size' will be considered as a large positive value, leading to a buffer overflow. Change the type of `size' to unsigned int to avoid buffer overflow, and simplify overflow checks accordingly. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | rtmp: fix multiple broken overflow checksXi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | Sanity checks like `data + size >= data_end || data + size < data' are broken, because `data + size < data' assumes pointer overflow, which is undefined behavior in C. Many compilers such as gcc/clang optimize such checks away. Use `size < 0 || size >= data_end - data' instead. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge commit '33f28a3be3092f642778253d9529dd66fe2a014a'Michael Niedermayer2013-01-01
|\| | | | | | | | | | | | | | | * commit '33f28a3be3092f642778253d9529dd66fe2a014a': rtmp: Add a function for writing AMF strings based on two substrings rtmp: Return a proper error code in handle_invoke_error Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Add a function for writing AMF strings based on two substringsMartin Storsjö2012-12-31
| | | | | | | | | | | | | | This avoids having to concatenate them into one buffer before writing them as AMF. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-08-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: x86: fft: fix imdct_half() for AVX rtmppkt: Add missing libavcodec/bytestream.h include. rtmp: add functions for reading AMF values vc1dec: remove useless #include simple_idct.h dct-test: always link with aandcttab.o vp8: pack struct VP8ThreadData more efficiently x86: remove libmpeg2 mmx(ext) idct functions eamad: Use dsputils instead of a custom bswap16_buf Canopus Lossless decoder Conflicts: Changelog LICENSE libavcodec/avcodec.h libavcodec/cllc.c libavcodec/eamad.c libavcodec/version.h Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: add functions for reading AMF valuesJordi Ortiz2012-08-02
| | | | | | | | Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-06-15
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: Avoid C99 variable declarations within for statements. rtmp: Read and handle incoming packets while writing data doc: document THREAD_TYPE fate variable rtpdec: Don't require frames to start with a Mode A packet avconv: don't try to free threads that were not initialized. Conflicts: doc/fate.texi ffplay.c libavdevice/dv1394.h Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Read and handle incoming packets while writing dataSamuel Pitoiset2012-06-14
| | | | | | | | | | | | | | | | | | | | | | This makes sure all incoming packets are read and handled (and reacted to) while sending an FLV stream over RTMP to a server. If there were enough incoming data to fill the TCP buffers, this could potentially make things block at unexpected places. For the upcoming RTMPT support, we need to consume all incoming data before we can send the next request. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-05-25
|\| | | | | | | | | | | | | | | | | | | * qatar/master: movenc: Don't write the 'wave' atom or its child 'enda' for lpcm audio. imc: some cosmetics rtmp: Pass the proper return code in rtmp_handshake rtmp: Check return codes of net IO operations Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Check return codes of net IO operationsSamuel Pitoiset2012-05-24
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-05-25
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: rtmp: Return a proper error code instead of -1 rtmp: Check malloc calls rtmp: Check ff_rtmp_packet_create calls lavfi: add audio mix filter flvdec: Make sure sample_rate is set to the updated value tqi: Pass errors from the MB decoder Conflicts: Changelog doc/filters.texi libavcodec/eatqi.c libavfilter/Makefile libavfilter/allfilters.c libavfilter/version.h Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Check ff_rtmp_packet_create callsSamuel Pitoiset2012-05-24
| | | | | | | | | | | | | | Check malloc calls used by ff_rtmp_packet_create, unify error handling and pass on error codes. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2011-12-12
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: x86: cabac: replace explicit memory references with "m" operands avplay: don't request a stereo downmix wmapro: use av_float2int() lavc: avoid invalid memcpy() in avcodec_default_release_buffer() lavu: replace int/float punning functions lavfi: install libavfilter/vsrc_buffer.h Remove extraneous semicolons sdp: Restore the original mp4 format h264 extradata if converted rtpenc: Add support for mp4 format h264 rtpenc: Simplify code by introducing a separate end pointer movenc: Use the actual converted sample for RTP hinting Fix a bunch of common typos. Conflicts: doc/developer.texi doc/eval.texi doc/filters.texi doc/protocols.texi ffmpeg.c ffplay.c libavcodec/mpegvideo.h libavcodec/x86/cabac.h libavfilter/Makefile libavformat/avformat.h libavformat/cafdec.c libavformat/flvdec.c libavformat/flvenc.c libavformat/gxfenc.c libavformat/img2.c libavformat/movenc.c libavformat/mpegts.c libavformat/rtpenc_h264.c libavformat/utils.c libavformat/wtv.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-11 10:56:57 +0000