[vlc-commits] [Git][videolan/vlc][master] 8 commits: demux: mp4: ignore empty reconstructed RTP packets
François Cartegnie (@fcartegnie)
gitlab at videolan.org
Fri Jul 24 15:21:32 UTC 2026
François Cartegnie pushed to branch master at VideoLAN / VLC
Commits:
2a973e0a by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: ignore empty reconstructed RTP packets
- - - - -
e744e728 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate RTP sample ranges
fixes #29979
Reported-by: HE WEI (ギカク) <skyexpoc at gmail.com>
- - - - -
3cd7824f by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: keep RTP buffer accounting consistent
- - - - -
6db4ecb0 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: simplify RTP payload ownership
- - - - -
a4d89aac by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: handle non terminated strings
regression by e018cc44508a62b381a5cbf256693a970cdc20b0
- - - - -
2e8207db by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate SDP text fields
- - - - -
52b1b881 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: handle missing SDP fields
- - - - -
87e08036 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate minimum RTP payload size
- - - - -
3 changed files:
- modules/demux/mp4/essetup.c
- modules/demux/mp4/libmp4.c
- modules/demux/mp4/mp4.c
Changes:
=====================================
modules/demux/mp4/essetup.c
=====================================
@@ -150,7 +150,7 @@ static int SetupRTPReceptionHintTrack( demux_t *p_demux, const mp4_track_t *p_tr
p_fmt->i_original_fourcc = i_sample_type;
const MP4_Box_t *p_sdp = MP4_BoxGet( p_track->p_track, "udta/hnti/sdp " );
- if( !p_sdp )
+ if( !p_sdp || !BOXDATA(p_sdp)->psz_text )
{
msg_Err(p_demux, "Required 'sdp '-box not found");
return 0;
=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -151,22 +151,23 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
if( *size == 0 )
return NULL;
- if( *in == 0 ) /* Null string stored */
+ size_t len = strnlen( (const char *)*in, *size );
+ if( len == 0 ) /* Null string stored */
{
*in += 1;
*size -= 1;
return NULL;
}
- size_t len = strnlen( (const char *)*in, *size );
- if( len == 0 || len >= *size )
- return NULL;
-
- len++;
-
- char *ret = malloc( len );
+ const bool b_terminated = len < *size;
+ char *ret = malloc( len + 1 );
if( likely(ret != NULL) )
+ {
memcpy( ret, *in, len );
+ ret[len] = 0; // ensure termination
+ }
+ if( b_terminated ) // terminated
+ len++;
*in += len;
*size -= len;
return ret;
=====================================
modules/demux/mp4/mp4.c
=====================================
@@ -39,6 +39,7 @@
#include <vlc_replay_gain.h>
#include <assert.h>
#include <limits.h>
+#include <stdckdint.h>
#include <math.h>
#include "meta.h"
#include "attachments.h"
@@ -1520,6 +1521,9 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
/* skip packet constructor */
p_slice += CONSTRUCTORSIZE;
+ if( sample_cons.length == 0 )
+ continue;
+
/* check that is RTPsampleconstructor, referencing itself and no weird audio stuff */
if( sample_cons.type != 2||sample_cons.trackrefindex != -1
||sample_cons.samplesperblock != 1||sample_cons.bytesperblock != 1 )
@@ -1529,15 +1533,24 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
}
/* slice doesn't fit in buffer */
- if( sample_cons.sampleoffset + sample_cons.length > p_block->i_buffer)
+ size_t slice_size;
+ if( ckd_add( &slice_size, sample_cons.sampleoffset, sample_cons.length ) ||
+ slice_size > p_block->i_buffer )
{
msg_Err(p_demux, "Sample buffer is smaller than sample" );
goto error;
}
+ size_t realloc_size;
+ if( ckd_add( &realloc_size, i_payload, sample_cons.length ) ||
+ ckd_add( &realloc_size, realloc_size, 4 ) )
+ {
+ goto error;
+ }
+
block_t *p_realloc = ( p_newblock ) ?
- block_Realloc( p_newblock, 0, i_payload + sample_cons.length + 4 ):
- block_Alloc( i_payload + sample_cons.length + 4 );
+ block_TryRealloc( p_newblock, 0, realloc_size ):
+ block_Alloc( realloc_size );
if( !p_realloc )
goto error;
@@ -1548,7 +1561,7 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
uint8_t i_type = (*p_src) & ((1<<5)-1);
const uint8_t synccode[4] = { 0, 0, 0, 1 };
- if( memcmp( p_src, synccode, 4 ) )
+ if( sample_cons.length < 4 || memcmp( p_src, synccode, 4 ) )
{
if( i_type == 7 || i_type == 8 )
*p_dst++=0;
@@ -1595,6 +1608,7 @@ static block_t * MP4_RTPHint_Convert( demux_t *p_demux, block_t *p_block, vlc_fo
if( i_packets == 1 && i_skip < p_block->i_buffer )
{
p_block->p_buffer += i_skip;
+ p_block->i_buffer -= i_skip;
p_converted = p_block;
}
else
@@ -3904,13 +3918,14 @@ static void MP4_TrackSetup( demux_t *p_demux, mp4_track_t *p_track,
MP4_Box_t *p_sdp;
/* parse the sdp message to find out whether the RTP stream contained audio or video */
- if( !( p_sdp = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) )
+ if( !( p_sdp = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) ||
+ !BOXDATA(p_sdp)->psz_text )
{
msg_Warn( p_demux, "Didn't find sdp box to determine stream type" );
return;
}
- memcpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
+ strncpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
if( !strcmp(sdp_media_type, "m=audio") )
{
msg_Dbg( p_demux, "Found audio Rtp: %s", sdp_media_type );
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/903ff61665479c3901e2438c572488ed7c85498e...87e08036c537b2802ad7887587af0d88331bdaa7
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/903ff61665479c3901e2438c572488ed7c85498e...87e08036c537b2802ad7887587af0d88331bdaa7
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list