diff --git a/gst/rtp/gstrtpgstdepay.c b/gst/rtp/gstrtpgstdepay.c index a34088025f..621aa4758c 100644 --- a/gst/rtp/gstrtpgstdepay.c +++ b/gst/rtp/gstrtpgstdepay.c @@ -279,7 +279,12 @@ read_event (GstRtpGSTDepay * rtpgstdepay, guint type, if (!read_length (rtpgstdepay, map.data, map.size, &length, &offset)) goto too_small; - if (length == 0 || map.data[offset + length - 1] != ';') + if (length == 0) + goto invalid_buffer; + if (map.data[offset + length - 1] != '\0') + goto invalid_buffer; + /* backward compat, old payloader did not put 0-byte at the end */ + if (map.data[offset + length - 1] != ';') goto invalid_buffer; GST_DEBUG_OBJECT (rtpgstdepay, "parsing event %s", &map.data[offset]); diff --git a/gst/rtp/gstrtpgstpay.c b/gst/rtp/gstrtpgstpay.c index c0a9d94d9f..08794d1c14 100644 --- a/gst/rtp/gstrtpgstpay.c +++ b/gst/rtp/gstrtpgstpay.c @@ -483,6 +483,8 @@ gst_rtp_gst_pay_send_event (GstRtpGSTPay * rtpgstpay, guint etype, estr = gst_structure_to_string (s); elen = strlen (estr); + /* for 0 byte */ + elen++; outbuf = make_data_buffer (rtpgstpay, estr, elen); GST_DEBUG_OBJECT (rtpgstpay, "sending event=%s", estr); g_free (estr);