Commit cd818b3a authored by Martin Storsjö's avatar Martin Storsjö
Browse files

rtmpproto: Validate the embedded flv packet size before copying

This wasn't an issue prior to 58404738

, when the whole RTMP packet
was copied at once and the length of the individual embedded flv
packets only were validated by the flv demuxer.

Prior to this patch, this could lead to reads and writes out of bound.
Signed-off-by: default avatarMartin Storsjö <martin@martin.st>
parent 8921e32f
......@@ -2221,6 +2221,8 @@ static int handle_metadata(RTMPContext *rt, RTMPPacket *pkt)
pts = cts;
ts += cts - pts;
pts = cts;
if (size + 3 + 4 > pkt->data + pkt->size - next)
break;
bytestream_put_byte(&p, type);
bytestream_put_be24(&p, size);
bytestream_put_be24(&p, ts);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment