From: Ederson de Souza <ederson.desouza@intel.com>
Date: Mon, 8 Jul 2019 21:19:07 +0000 (-0700)
Subject: avtp: CVF - Do not infinite loop trying to fragment zero sized NAL unit
X-Git-Tag: 1.19.3~507^2~3044
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f9a16731d15843955f4ef52f34d846b74d9bd02e;p=platform%2Fupstream%2Fgstreamer.git

avtp: CVF - Do not infinite loop trying to fragment zero sized NAL unit

Zero sized NAL-units should not happen, but if they do, do not infinite
loop. Added also a unit test for this case.
---

diff --git a/ext/avtp/gstavtpcvfpay.c b/ext/avtp/gstavtpcvfpay.c
index 2567632..c2eaaa0 100644
--- a/ext/avtp/gstavtpcvfpay.c
+++ b/ext/avtp/gstavtpcvfpay.c
@@ -249,6 +249,11 @@ gst_avtp_cvf_pay_extract_nals (GstAvtpCvfPay * avtpcvfpay,
       nal_len = (nal_len << 8) + data[i];
     }
 
+    if (nal_len == 0) {
+      GST_WARNING_OBJECT (avtpcvfpay, "Invalid NAL unit size: 0");
+      break;
+    }
+
     offset += avtpcvfpay->nal_length_size;
     data += avtpcvfpay->nal_length_size;
     size -= avtpcvfpay->nal_length_size;
diff --git a/tests/check/elements/avtpcvfpay.c b/tests/check/elements/avtpcvfpay.c
index 9f92ba8..9e6c13b 100644
--- a/tests/check/elements/avtpcvfpay.c
+++ b/tests/check/elements/avtpcvfpay.c
@@ -137,6 +137,38 @@ compare_h264_avtpdu (struct avtp_stream_pdu *pdu, GstBuffer * buffer)
   return result;
 }
 
+GST_START_TEST (test_payloader_zero_sized_nal)
+{
+  GstHarness *h;
+  GstBuffer *in;
+  GstMapInfo map;
+
+  /* Create the harness for the avtpcvfpay */
+  h = gst_harness_new_parse
+      ("avtpcvfpay streamid=0xAABBCCDDEEFF0001 mtt=1000000 tu=1000000 processing-deadline=0");
+  gst_harness_set_src_caps (h, generate_caps (4));
+
+  /* We have the buffer with the nal size (4 bytes) and the nal (4 bytes), but
+   * nal size will be zero */
+  in = gst_harness_create_buffer (h, 8);
+  GST_BUFFER_DTS (in) = 1000000;
+  GST_BUFFER_PTS (in) = 2000000;
+
+  gst_buffer_map (in, &map, GST_MAP_READWRITE);
+  map.data[0] = map.data[1] = map.data[2] = map.data[3] = 0;    /* Set NAL size to 0 */
+  map.data[4] = 1;              /* Some dummy vcl NAL type */
+  gst_buffer_unmap (in, &map);
+
+  gst_harness_push (h, in);
+
+  /* No buffer shuld come out */
+  fail_unless_equals_int (gst_harness_buffers_received (h), 0);
+
+  gst_harness_teardown (h);
+}
+
+GST_END_TEST;
+
 GST_START_TEST (test_payloader_no_codec_data)
 {
   GstHarness *h;
@@ -641,6 +673,7 @@ avtpcvfpay_suite (void)
   tcase_add_test (tc_chain, test_payloader_invalid_caps);
   tcase_add_test (tc_chain, test_payloader_properties);
   tcase_add_test (tc_chain, test_payloader_no_codec_data);
+  tcase_add_test (tc_chain, test_payloader_zero_sized_nal);
 
   return s;
 }