Commit a4fec9a7 authored by Michael Niedermayer's avatar Michael Niedermayer Committed by Martin Storsjö

rtmppkt: Check for packet size mismatches

When receiving fragmented packets, the first packet declares the size,
and the later ones normally are small follow-on packets that don't repeat
the size and the other header fields. But technically, the later fragments
also can have a full header, declaring a different size than the previous
packet.

If the follow-on packet declares a larger size than the initial one, we
could end up writing outside of the allocation.

This fixes out of bounds writes.
Found-by: 's avatarPaul Cher <paulcher@icloud.com>
Reviewed-by: 's avatarPaul Cher <paulcher@icloud.com>

CC: libav-stable@libav.org
Signed-off-by: 's avatarMartin Storsjö <martin@martin.st>
parent cdcfa97d
...@@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p, ...@@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,
if (hdr != RTMP_PS_TWELVEBYTES) if (hdr != RTMP_PS_TWELVEBYTES)
timestamp += prev_pkt[channel_id].timestamp; timestamp += prev_pkt[channel_id].timestamp;
if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {
av_log(h, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",
size, prev_pkt[channel_id].size);
ff_rtmp_packet_destroy(&prev_pkt[channel_id]);
prev_pkt[channel_id].read = 0;
return AVERROR_INVALIDDATA;
}
if (!prev_pkt[channel_id].read) { if (!prev_pkt[channel_id].read) {
if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp, if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp,
size)) < 0) size)) < 0)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment