From 8ea1459bc32b55441fb49311fcee4f9f0fcf39b9 Mon Sep 17 00:00:00 2001 From: Samuel Pitoiset Date: Thu, 26 Jul 2012 20:45:42 +0200 Subject: [PATCH] rtmp: Check the buffer length of ping packets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Martin Storsjö --- libavformat/rtmpproto.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 4e5eddb69a..501e0eddc7 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -515,6 +515,12 @@ static int gen_pong(URLContext *s, RTMPContext *rt, RTMPPacket *ppkt) uint8_t *p; int ret; + if (ppkt->data_size < 6) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + ppkt->data_size); + return AVERROR_INVALIDDATA; + } + if ((ret = ff_rtmp_packet_create(&pkt, RTMP_NETWORK_CHANNEL, RTMP_PT_PING, ppkt->timestamp + 1, 6)) < 0) return ret; @@ -913,6 +919,12 @@ static int handle_ping(URLContext *s, RTMPPacket *pkt) RTMPContext *rt = s->priv_data; int t, ret; + if (pkt->data_size < 2) { + av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n", + pkt->data_size); + return AVERROR_INVALIDDATA; + } + t = AV_RB16(pkt->data); if (t == 6) { if ((ret = gen_pong(s, rt, pkt)) < 0)