From 8a78fa1ff5a4e1a620cb1e0747e5b560bf4e8b80 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Thu, 19 Jun 2014 15:25:01 +0200 Subject: [PATCH] vp8depay: fix header size checking Use a different variable name to make it clear that we are calculating the header size. Correctly check that we have enough bytes to read the header bits. We were checking if there were 5 bytes available in the header while we only needed 3, causing the packet to be discarded as too small. Fixes https://bugzilla.gnome.org/show_bug.cgi?id=723595 --- gst/rtp/gstrtpvp8depay.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/gst/rtp/gstrtpvp8depay.c b/gst/rtp/gstrtpvp8depay.c index 7cc4504a4d..40f3375e22 100644 --- a/gst/rtp/gstrtpvp8depay.c +++ b/gst/rtp/gstrtpvp8depay.c @@ -106,7 +106,7 @@ gst_rtp_vp8_depay_process (GstRTPBaseDepayload * depay, GstBuffer * buf) GstRtpVP8Depay *self = GST_RTP_VP8_DEPAY (depay); GstBuffer *payload; guint8 *data; - guint offset; + guint hdrsize; guint size; GstRTPBuffer rtpbuffer = GST_RTP_BUFFER_INIT; @@ -134,31 +134,32 @@ gst_rtp_vp8_depay_process (GstRTPBaseDepayload * depay, GstBuffer * buf) self->started = TRUE; } - offset = 1; + hdrsize = 1; /* Check X optional header */ if ((data[0] & 0x80) != 0) { - offset++; + hdrsize++; /* Check I optional header */ if ((data[1] & 0x80) != 0) { - offset++; - if (G_UNLIKELY (offset + 2 >= size)) + if (G_UNLIKELY (size < 3)) goto too_small; + hdrsize++; /* Check for 16 bits PictureID */ if ((data[2] & 0x80) != 0) - offset++; + hdrsize++; } /* Check L optional header */ if ((data[1] & 0x40) != 0) - offset++; + hdrsize++; /* Check T or K optional headers */ if ((data[1] & 0x20) != 0 || (data[1] & 0x10) != 0) - offset++; + hdrsize++; } + GST_DEBUG_OBJECT (depay, "hdrsize %u, size %u", hdrsize, size); - if (G_UNLIKELY (offset >= size)) + if (G_UNLIKELY (hdrsize >= size)) goto too_small; - payload = gst_rtp_buffer_get_payload_subbuffer (&rtpbuffer, offset, -1); + payload = gst_rtp_buffer_get_payload_subbuffer (&rtpbuffer, hdrsize, -1); gst_adapter_push (self->adapter, payload); /* Marker indicates that it was the last rtp packet for this frame */