summaryrefslogtreecommitdiff
path: root/libavformat/rtmppkt.c
Commit message (Collapse)AuthorAge
* Merge commit 'a1a143adb0fd11c474221431417cff25db7d920f'James Almer2017-09-26
|\ | | | | | | | | | | | | * commit 'a1a143adb0fd11c474221431417cff25db7d920f': rtmp: Rename packet types to closer match the spec Merged-by: James Almer <jamrial@gmail.com>
| * rtmp: Rename packet types to closer match the specMartin Storsjö2017-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also rename comments and log messages accordingly, and add clarifying comments for some hardcoded values. The previous names were taken from older, reverse engineered references. These names match the official public rtmp specification, and matches the names used by wirecast in annotating captured streams. These names also avoid hardcoding the roles of server and client, since the handling of them is irrelevant of whether we act as server or client. The RTMP_PT_PING type maps to RTMP_PT_USER_CONTROL. The SERVER_BW and CLIENT_BW types are a bit more intertwined; RTMP_PT_SERVER_BW maps to RTMP_PT_WINDOW_ACK_SIZE and RTMP_PT_CLIENT_BW maps to RTMP_PT_SET_PEER_BW. Signed-off-by: Martin Storsjö <martin@martin.st>
* | avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2Michael Niedermayer2017-07-29
| | | | | | | | | | | | | | Fixes: out of array accesses Found-by: JunDong Xie of Ant-financial Light-Year Security Lab Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2Michael Niedermayer2017-07-29
| | | | | | | | | | | | | | | | Fixes: out of array accesses Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV Found-by: JunDong Xie of Ant-financial Light-Year Security Lab Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Merge commit 'a4fec9a7eab842ea5eea1b1ee98624356cb31422'Clément Bœsch2017-04-26
|\| | | | | | | | | | | | | | | | | * commit 'a4fec9a7eab842ea5eea1b1ee98624356cb31422': rtmppkt: Check for packet size mismatches See 7d57ca4d9a75562fa32e40766211de150f8b3ee7 Merged-by: Clément Bœsch <u@pkh.me>
| * rtmppkt: Check for packet size mismatchesMichael Niedermayer2016-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When receiving fragmented packets, the first packet declares the size, and the later ones normally are small follow-on packets that don't repeat the size and the other header fields. But technically, the later fragments also can have a full header, declaring a different size than the previous packet. If the follow-on packet declares a larger size than the initial one, we could end up writing outside of the allocation. This fixes out of bounds writes. Found-by: Paul Cher <paulcher@icloud.com> Reviewed-by: Paul Cher <paulcher@icloud.com> CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
* | avformat/rtmppkt: Check for packet size mismatchesMichael Niedermayer2016-12-05
| | | | | | | | | | | | | | | | Fixes out of array access Found-by: Paul Cher <paulcher@icloud.com> Reviewed-by: Paul Cher <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | rtmp: support the AMF_DATE tagAndrew Stone2015-09-01
| | | | | | | | | | | | | | | | Instead of returning EINVAL, which can cause a stream to fail to load, this allows the tag to be passed through to the flv demuxer, where it's summarily ignored. Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Merge commit '024e5a2d5ff8a94adce48abb15ce2fb471f9d18e'Michael Niedermayer2015-01-15
|\| | | | | | | | | | | | | * commit '024e5a2d5ff8a94adce48abb15ce2fb471f9d18e': rtmppkt: Repeat the full 32 bit timestamp for chunking continuation packets Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Repeat the full 32 bit timestamp for chunking continuation packetsMartin Storsjö2015-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes sending chunked packets (packets larger than the output chunk size, which often can be e.g. 4096 bytes) with a timestamp delta (or absolute timstamp, if it's a timestamp step backwards, or the first packet of the stream) larger than 0xffffffff. The RTMP spec explicitly says (in section 5.3.1.3.) that packets of type 3 (continuation packets) should include this field, if the previous non-continuation packet had it included. The receiving code handles these packets correctly. Pointed out by Cheolho Park. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '44127b157e9f8acb837d4bb3a094f56b40da3ef5'Michael Niedermayer2014-11-28
|\| | | | | | | | | | | | | * commit '44127b157e9f8acb837d4bb3a094f56b40da3ef5': rtmppkt: Make pkt->data reallocable Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Make pkt->data reallocableMartin Storsjö2014-11-28
| | | | | | | | | | | | | | | | We try to avoid mixing av_malloc with av_realloc, since av_malloc may be implemented with functions that can't (formally) be mixed with the functions used in av_realloc. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '3b18857ab301d2a0b3e86e9d85eed76f0798a29c'Michael Niedermayer2014-06-01
|\| | | | | | | | | | | | | * commit '3b18857ab301d2a0b3e86e9d85eed76f0798a29c': rtmppkt: Add method to read an AMF string that is not prefixed by its type Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Add method to read an AMF string that is not prefixed by its typeUwe L. Korn2014-06-01
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | avformat/rtmppkt: Fix random crashkyh964032014-04-23
| | | | | | | | | | | | Fixes Ticket3564 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * qatar/master: rtmppkt: Rename the ts_delta field to ts_field Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Rename the ts_delta field to ts_fieldMartin Storsjö2014-03-07
| | | | | | | | | | | | | | | | | | | | | | Based on a suggestion by Martin Panter. This is more descriptive, since it's the actual timestamp field from the RTMP packet, which might or might not be a delta depending on context (in some packets it's a delta, in some packets it's an absolute timestamp, and in some packets it's 0xffffff to indicate that the actual delta or absolute timestamp is transmitted separately). Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '8bbb02ae4f44f1cddc1ce1e74a71fa2022e93da3'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '8bbb02ae4f44f1cddc1ce1e74a71fa2022e93da3': rtmppkt: Properly handle extended timestamps when writing Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Properly handle extended timestamps when writingMartin Panter2014-03-07
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '48cfb5f4114048383a4ee85b2f500eefce24cad2'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '48cfb5f4114048383a4ee85b2f500eefce24cad2': rtmppkt: Add a descriptive comment Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Add a descriptive commentMartin Panter2014-03-07
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '5b2ad78f97d43299adcb038c04346999fe9b196c'Michael Niedermayer2014-03-07
|\| | | | | | | | | | | | | * commit '5b2ad78f97d43299adcb038c04346999fe9b196c': rtmppkt: Handle extended timestamp field even for one-byte header Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmppkt: Handle extended timestamp field even for one-byte headerMartin Panter2014-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Related fix in "rtmpdump": https://repo.or.cz/w/rtmpdump.git/commitdiff/79459a2 Adobe's RTMP specification (21 Dec 2012), section 5.3.1.3 ("Extended Timestamp"), says "this field is present in Type 3 chunks". Type 3 chunks are those with the one-byte header size. This resolves intermittent hangs and segfaults caused by the read function, and also includes an untested fix for the write function. The read function was tested with ABC (Australia) News 24 streams, however they are probably restricted to only Australian internet addresses. Some of the packets at the start of these streams seem to contain junk timestamp fields, often requiring the extended field. Test command: avplay rtmp://cp81899.live.edgefcs.net/live/news24-med@28772 Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '89564be444d24f75ea5add8b6987e414cf7aa7d5'Michael Niedermayer2014-01-21
|\| | | | | | | | | | | | | * commit '89564be444d24f75ea5add8b6987e414cf7aa7d5': rtmpproto: Send a full, absolute timestamp if it isn't monotonically growing Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmpproto: Send a full, absolute timestamp if it isn't monotonically growingMartin Storsjö2014-01-20
| | | | | | | | | | | | | | | | The normal differential timestamps can't handle negative differences, thus send a full packet header with an absolute timestamp in these cases. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '84a125c4c28f3e3e215d2e6c32f7f0ec43bbc04c'Michael Niedermayer2013-10-14
|\| | | | | | | | | | | | | * commit '84a125c4c28f3e3e215d2e6c32f7f0ec43bbc04c': rtmp: Allocate the prev_pkt arrays dynamically Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Allocate the prev_pkt arrays dynamicallyMartin Storsjö2013-10-14
| | | | | | | | | | | | | | | | | | | | Normally, all channel ids are between 0 and 10, while they in uncommon cases can have values up to 64k. This avoids allocating two arrays for up to 64k entries (at a total of over 6 MB in size) each when most of them aren't used at all. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '32a414f316c7f0eea877370e3f9d9f25afbf5da2'Michael Niedermayer2013-09-23
|\| | | | | | | | | | | | | * commit '32a414f316c7f0eea877370e3f9d9f25afbf5da2': rtmp: Support AMF_DATA_TYPE_MIXEDARRAY Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Support AMF_DATA_TYPE_MIXEDARRAYLuca Barbato2013-09-22
| | | | | | | | | | | | | | | | | | And fix the AMF_DATA_TYPE_ARRAY parsing while at it. A MIXEDARRAY type, as the ARRAY, store the number of elements in an uint32 before the list. The ARRAY is strict and does not have an OBJECT terminator, MIXEDARRAY behaves like an OBJECT type and a different than stated number of element can be present.
* | Merge commit '8583b14252deac71136f1dec231910abab0ba503'Michael Niedermayer2013-09-18
|\| | | | | | | | | | | | | * commit '8583b14252deac71136f1dec231910abab0ba503': rtmp: Support reading interleaved chunks. Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Support reading interleaved chunks.Josh Allmann2013-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A given packet won't always come in contiguously; sometimes they may be broken up on chunk boundaries by packets of another channel. This support primarily involves tracking information about the data that's been read, so the reader can pick up where it left off for a given channel. As a side effect, we no longer over-report the bytes read if (toread = MIN(size, chunk_size)) == size Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2013-08-11
|\| | | | | | | | | | | | | * qatar/master: rtmp: Do not misuse memcmp Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Do not misuse memcmpLuca Barbato2013-08-11
| | | | | | | | CC: libav-stable@libav.org
* | Merge commit 'ba5393a609c723ec8ab7f9727c10fef734c09278'Michael Niedermayer2013-08-11
|\| | | | | | | | | | | | | * commit 'ba5393a609c723ec8ab7f9727c10fef734c09278': rtmp: rename data_size to size Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: rename data_size to sizeLuca Barbato2013-08-10
| |
* | Merge commit '28306e6d620c109ddd672f7243adfbc2bbb3b18f'Michael Niedermayer2013-06-02
|\| | | | | | | | | | | | | | | | | | | | | * commit '28306e6d620c109ddd672f7243adfbc2bbb3b18f': network: factor out bind-listening code use my full first name instead of short one in copyrights Conflicts: libavformat/tcp.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * use my full first name instead of short one in copyrightsKostya Shishkov2013-06-01
| |
* | Merge commit 'e926b5ceb1962833f0c884a328382bc2eca67aff'Michael Niedermayer2013-05-01
|\| | | | | | | | | | | | | | | | | | | | | | | * commit 'e926b5ceb1962833f0c884a328382bc2eca67aff': avformat: Drop unnecessary ff_ name prefixes from static functions Conflicts: libavformat/audiointerleave.c libavformat/mux.c libavformat/mxfenc.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * avformat: Drop unnecessary ff_ name prefixes from static functionsDiego Biurrun2013-04-30
| |
| * rtmp: fix buffer overflows in ff_amf_tag_contents()Xi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A negative `size' will bypass FFMIN(). In the subsequent memcpy() call, `size' will be considered as a large positive value, leading to a buffer overflow. Change the type of `size' to unsigned int to avoid buffer overflow, and simplify overflow checks accordingly. Also change a literal buffer size to use sizeof, and limit the amount of data copied in another memcpy call as well. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Martin Storsjö <martin@martin.st>
| * rtmp: fix multiple broken overflow checksXi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | Sanity checks like `data + size >= data_end || data + size < data' are broken, because `data + size < data' assumes pointer overflow, which is undefined behavior in C. Many compilers such as gcc/clang optimize such checks away. Use `size < 0 || size >= data_end - data' instead. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Martin Storsjö <martin@martin.st>
* | rtmp: fix buffer overflows in ff_amf_tag_contents()Xi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | A negative `size' will bypass FFMIN(). In the subsequent memcpy() call, `size' will be considered as a large positive value, leading to a buffer overflow. Change the type of `size' to unsigned int to avoid buffer overflow, and simplify overflow checks accordingly. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | rtmp: fix multiple broken overflow checksXi Wang2013-01-23
| | | | | | | | | | | | | | | | | | | | | | | | Sanity checks like `data + size >= data_end || data + size < data' are broken, because `data + size < data' assumes pointer overflow, which is undefined behavior in C. Many compilers such as gcc/clang optimize such checks away. Use `size < 0 || size >= data_end - data' instead. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge commit '33f28a3be3092f642778253d9529dd66fe2a014a'Michael Niedermayer2013-01-01
|\| | | | | | | | | | | | | | | * commit '33f28a3be3092f642778253d9529dd66fe2a014a': rtmp: Add a function for writing AMF strings based on two substrings rtmp: Return a proper error code in handle_invoke_error Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Add a function for writing AMF strings based on two substringsMartin Storsjö2012-12-31
| | | | | | | | | | | | | | This avoids having to concatenate them into one buffer before writing them as AMF. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-08-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: x86: fft: fix imdct_half() for AVX rtmppkt: Add missing libavcodec/bytestream.h include. rtmp: add functions for reading AMF values vc1dec: remove useless #include simple_idct.h dct-test: always link with aandcttab.o vp8: pack struct VP8ThreadData more efficiently x86: remove libmpeg2 mmx(ext) idct functions eamad: Use dsputils instead of a custom bswap16_buf Canopus Lossless decoder Conflicts: Changelog LICENSE libavcodec/avcodec.h libavcodec/cllc.c libavcodec/eamad.c libavcodec/version.h Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: add functions for reading AMF valuesJordi Ortiz2012-08-02
| | | | | | | | Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-06-15
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/master: Avoid C99 variable declarations within for statements. rtmp: Read and handle incoming packets while writing data doc: document THREAD_TYPE fate variable rtpdec: Don't require frames to start with a Mode A packet avconv: don't try to free threads that were not initialized. Conflicts: doc/fate.texi ffplay.c libavdevice/dv1394.h Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * rtmp: Read and handle incoming packets while writing dataSamuel Pitoiset2012-06-14
| | | | | | | | | | | | | | | | | | | | | | This makes sure all incoming packets are read and handled (and reacted to) while sending an FLV stream over RTMP to a server. If there were enough incoming data to fill the TCP buffers, this could potentially make things block at unexpected places. For the upcoming RTMPT support, we need to consume all incoming data before we can send the next request. Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge remote-tracking branch 'qatar/master'Michael Niedermayer2012-05-25
|\| | | | | | | | | | | | | | | | | | | * qatar/master: movenc: Don't write the 'wave' atom or its child 'enda' for lpcm audio. imc: some cosmetics rtmp: Pass the proper return code in rtmp_handshake rtmp: Check return codes of net IO operations Merged-by: Michael Niedermayer <michaelni@gmx.at>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-04 13:20:06 +0000