gst_buffer_map (in, &map, GST_MAP_READ);
+ if (map.size < offset)
+ goto not_enough_data;
+
data = map.data + offset;
size = map.size - offset;
}
GST_DEBUG_OBJECT (rmdemux, "fragment size %d", fragment_size);
+ if (map.size < (data - map.data) + fragment_size)
+ goto not_enough_data;
+
/* get the fragment */
fragment =
gst_buffer_copy_region (in, GST_BUFFER_COPY_ALL, data - map.data,
GstFlowReturn ret;
GstBuffer *buffer;
+ if (gst_buffer_get_size (in) < offset)
+ goto not_enough_data;
+
buffer = gst_buffer_copy_region (in, GST_BUFFER_COPY_MEMORY, offset, -1);
if (rmdemux->first_ts != -1 && timestamp > rmdemux->first_ts)
ret = gst_pad_push (stream->pad, buffer);
}
+done:
gst_buffer_unref (in);
return ret;
+
+ /* ERRORS */
+not_enough_data:
+ {
+ GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."),
+ (NULL));
+ ret = GST_FLOW_OK;
+ goto done;
+ }
}
static GstFlowReturn
data = map.data;
size = map.size;
+ if (size < 4 + 6 + 1 + 2)
+ goto not_enough_data;
+
/* stream number */
id = RMDEMUX_GUINT16_GET (data);
/* version 1 has an extra byte */
if (version == 1) {
+ if (size < 1)
+ goto not_enough_data;
+
data += 1;
size -= 1;
}
gst_buffer_unref (in);
return GST_FLOW_OK;
}
+
+ /* ERRORS */
+not_enough_data:
+ {
+ GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."),
+ (NULL));
+ gst_buffer_unmap (in, &map);
+ gst_buffer_unref (in);
+ return GST_FLOW_OK;
+ }
}
gboolean