From e12457f1388459f421008463af6722f15ff20a29 Mon Sep 17 00:00:00 2001
From: Jonas Holmberg <jonashg@axis.com>
Date: Thu, 27 Sep 2012 15:42:56 +0200
Subject: [PATCH] rtpjpegpay: handle width and height > 2040

If width or height is greater than 2040 set width and height to zero in
the rtp header and add x-dimensions to outcaps.

Solves #684955
---
 gst/rtp/gstrtpjpegpay.c | 58 +++++++++++++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 11 deletions(-)

diff --git a/gst/rtp/gstrtpjpegpay.c b/gst/rtp/gstrtpjpegpay.c
index d80c80e168..7e9a737b1a 100644
--- a/gst/rtp/gstrtpjpegpay.c
+++ b/gst/rtp/gstrtpjpegpay.c
@@ -280,6 +280,8 @@ gst_rtp_jpeg_pay_init (GstRtpJPEGPay * pay)
   pay->quality = DEFAULT_JPEG_QUALITY;
   pay->quant = DEFAULT_JPEG_QUANT;
   pay->type = DEFAULT_JPEG_TYPE;
+  pay->width = -1;
+  pay->height = -1;
 }
 
 static gboolean
@@ -288,26 +290,46 @@ gst_rtp_jpeg_pay_setcaps (GstRTPBasePayload * basepayload, GstCaps * caps)
   GstStructure *caps_structure = gst_caps_get_structure (caps, 0);
   GstRtpJPEGPay *pay;
   gboolean res;
-  gint width = 0, height = 0;
+  gint width = -1, height = -1;
 
   pay = GST_RTP_JPEG_PAY (basepayload);
 
   /* these properties are not mandatory, we can get them from the SOF, if there
    * is one. */
   if (gst_structure_get_int (caps_structure, "height", &height)) {
-    if (height <= 0 || height > 2040)
+    if (height <= 0) {
       goto invalid_dimension;
+    }
   }
-  pay->height = GST_ROUND_UP_8 (height) / 8;
 
   if (gst_structure_get_int (caps_structure, "width", &width)) {
-    if (width <= 0 || width > 2040)
+    if (width <= 0) {
       goto invalid_dimension;
+    }
+  }
+
+  if (height > 2040 || width > 2040) {
+    pay->height = 0;
+    pay->width = 0;
+  } else {
+    pay->height = GST_ROUND_UP_8 (height) / 8;
+    pay->width = GST_ROUND_UP_8 (width) / 8;
   }
-  pay->width = GST_ROUND_UP_8 (width) / 8;
 
   gst_rtp_base_payload_set_options (basepayload, "video", TRUE, "JPEG", 90000);
-  res = gst_rtp_base_payload_set_outcaps (basepayload, NULL);
+
+  if (pay->width == 0) {
+    gchar *dim;
+
+    GST_DEBUG_OBJECT (pay,
+        "width or height are greater than 2040, adding x-dimensions to caps");
+    dim = g_strdup_printf ("%d,%d", width, height);
+    res = gst_rtp_base_payload_set_outcaps (basepayload, "x-dimensions",
+        G_TYPE_STRING, dim, NULL);
+    g_free (dim);
+  } else {
+    res = gst_rtp_base_payload_set_outcaps (basepayload, NULL);
+  }
 
   return res;
 
@@ -439,13 +461,26 @@ gst_rtp_jpeg_pay_read_sof (GstRtpJPEGPay * pay, const guint8 * data,
 
   GST_LOG_OBJECT (pay, "got dimensions %ux%u", height, width);
 
-  if (height == 0 || height > 2040)
+  if (height == 0) {
     goto invalid_dimension;
-  if (width == 0 || width > 2040)
+  }
+  if (height > 2040) {
+    height = 0;
+  }
+  if (width == 0) {
     goto invalid_dimension;
+  }
+  if (width > 2040) {
+    width = 0;
+  }
 
-  pay->height = GST_ROUND_UP_8 (height) / 8;
-  pay->width = GST_ROUND_UP_8 (width) / 8;
+  if (height == 0 || width == 0) {
+    pay->height = 0;
+    pay->width = 0;
+  } else {
+    pay->height = GST_ROUND_UP_8 (height) / 8;
+    pay->width = GST_ROUND_UP_8 (width) / 8;
+  }
 
   /* we only support 3 components */
   if (data[off++] != 3)
@@ -683,8 +718,9 @@ gst_rtp_jpeg_pay_handle_buffer (GstRTPBasePayload * basepayload,
 
   /* by now we should either have negotiated the width/height or the SOF header
    * should have filled us in */
-  if (pay->width == 0 || pay->height == 0)
+  if (pay->width < 0 || pay->height < 0) {
     goto no_dimension;
+  }
 
   GST_LOG_OBJECT (pay, "header size %u", jpeg_header_size);