From 2d6fd0f72d5b0a231470db9cd93d99444b632a13 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Tue, 21 Aug 2012 11:49:36 +0200 Subject: [PATCH] rtp: fix extension length calculation --- gst-libs/gst/rtp/gstrtpbuffer.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/gst-libs/gst/rtp/gstrtpbuffer.c b/gst-libs/gst/rtp/gstrtpbuffer.c index cb8237f64a..2f671ba17b 100644 --- a/gst-libs/gst/rtp/gstrtpbuffer.c +++ b/gst-libs/gst/rtp/gstrtpbuffer.c @@ -316,6 +316,7 @@ gst_rtp_buffer_map (GstBuffer * buffer, GstMapFlags flags, GstRTPBuffer * rtp) data = rtp->data[0] = rtp->map[0].data; size = rtp->map[0].size; + /* the header must be completely in the first buffer */ header_len = GST_RTP_HEADER_LEN; if (G_UNLIKELY (size < header_len)) goto wrong_length; @@ -338,7 +339,8 @@ gst_rtp_buffer_map (GstBuffer * buffer, GstMapFlags flags, GstRTPBuffer * rtp) guint8 *extdata; guint16 extlen; - /* find memory for the extension bits */ + /* find memory for the extension bits, we find the block for the first 4 + * bytes, all other extension bytes should also be in this block */ if (!gst_buffer_find_memory (buffer, header_len, 4, &idx, &length, &skip)) goto wrong_length; @@ -350,8 +352,15 @@ gst_rtp_buffer_map (GstBuffer * buffer, GstMapFlags flags, GstRTPBuffer * rtp) extdata += 2; /* read length as the number of 32 bits words */ extlen = GST_READ_UINT16_BE (extdata); + extlen *= sizeof (guint32); + /* add id and length */ + extlen += 4; - rtp->size[1] = extlen * sizeof (guint32); + /* all extension bytes must be in this block */ + if (G_UNLIKELY (rtp->map[1].size < extlen)) + goto wrong_length; + + rtp->size[1] = extlen; header_len += rtp->size[1]; } else { -- 2.34.1