[2/2] rtpdec: Read the packet length for all RTCP packet types

Message ID 1318407542-45536-2-git-send-email-martin@martin.st
State Committed
Commit 07b77fe3871f86b87e35876d38f1969da5ece4b2
Headers show

Commit Message

Martin Storsjö Oct. 12, 2011, 8:19 a.m.
From: John Brooks <john.brooks@bluecherry.net>

This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.
---
 libavformat/rtpdec.c |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

Comments

Anton Khirnov Oct. 12, 2011, 9:06 a.m. | #1
On Wed, 12 Oct 2011 11:19:02 +0300, Martin Storsjö <martin@martin.st> wrote:
> From: John Brooks <john.brooks@bluecherry.net>
> 
> This allows skipping past unsupported RTCP packet types, as
> RFC 3550 section 6.1 mandates.
> 
> Currently this only has any practical effect if a sender puts
> an unrecognized type before RTCP_BYE in a compounded packet, or
> (incorrectly) does not put RTCP_SR first.
> ---

LGTM.
Martin Storsjö Oct. 12, 2011, 11:39 a.m. | #2
On Wed, 12 Oct 2011, Anton Khirnov wrote:

>
> On Wed, 12 Oct 2011 11:19:02 +0300, Martin Storsjö <martin@martin.st> wrote:
>> From: John Brooks <john.brooks@bluecherry.net>
>>
>> This allows skipping past unsupported RTCP packet types, as
>> RFC 3550 section 6.1 mandates.
>>
>> Currently this only has any practical effect if a sender puts
>> an unrecognized type before RTCP_BYE in a compounded packet, or
>> (incorrectly) does not put RTCP_SR first.
>> ---
>
> LGTM.

Applied both of them.

// Martin

Patch

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index 07f4cc3..0f6ed27 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -112,14 +112,15 @@  RTPDynamicProtocolHandler *ff_rtp_handler_find_by_id(int id,
 static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len)
 {
     int payload_len;
-    while (len >= 2) {
+    while (len >= 4) {
+        payload_len = FFMIN(len, (AV_RB16(buf + 2) + 1) * 4);
+
         switch (buf[1]) {
         case RTCP_SR:
-            if (len < 20) {
+            if (payload_len < 20) {
                 av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n");
                 return AVERROR_INVALIDDATA;
             }
-            payload_len = (AV_RB16(buf + 2) + 1) * 4;
 
             s->last_rtcp_ntp_time = AV_RB64(buf + 8);
             s->last_rtcp_timestamp = AV_RB32(buf + 16);
@@ -130,14 +131,13 @@  static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int l
                 s->rtcp_ts_offset = s->last_rtcp_timestamp - s->base_timestamp;
             }
 
-            buf += payload_len;
-            len -= payload_len;
             break;
         case RTCP_BYE:
             return -RTCP_BYE;
-        default:
-            return -1;
         }
+
+        buf += payload_len;
+        len -= payload_len;
     }
     return -1;
 }