[vlc-commits] [Git][videolan/vlc][master] 8 commits: demux: mp4: ignore empty reconstructed RTP packets

François Cartegnie (@fcartegnie) gitlab at videolan.org
Fri Jul 24 15:21:32 UTC 2026



François Cartegnie pushed to branch master at VideoLAN / VLC


Commits:
2a973e0a by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: ignore empty reconstructed RTP packets

- - - - -
e744e728 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate RTP sample ranges

fixes #29979
Reported-by: HE WEI (ギカク) <skyexpoc at gmail.com>

- - - - -
3cd7824f by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: keep RTP buffer accounting consistent

- - - - -
6db4ecb0 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: simplify RTP payload ownership

- - - - -
a4d89aac by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: handle non terminated strings

regression by e018cc44508a62b381a5cbf256693a970cdc20b0

- - - - -
2e8207db by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate SDP text fields

- - - - -
52b1b881 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: handle missing SDP fields

- - - - -
87e08036 by François Cartegnie at 2026-07-24T17:08:43+02:00
demux: mp4: validate minimum RTP payload size

- - - - -


3 changed files:

- modules/demux/mp4/essetup.c
- modules/demux/mp4/libmp4.c
- modules/demux/mp4/mp4.c


Changes:

=====================================
modules/demux/mp4/essetup.c
=====================================
@@ -150,7 +150,7 @@ static int SetupRTPReceptionHintTrack( demux_t *p_demux, const mp4_track_t *p_tr
     p_fmt->i_original_fourcc = i_sample_type;
 
     const MP4_Box_t *p_sdp = MP4_BoxGet( p_track->p_track, "udta/hnti/sdp " );
-    if( !p_sdp )
+    if( !p_sdp || !BOXDATA(p_sdp)->psz_text )
     {
         msg_Err(p_demux, "Required 'sdp '-box not found");
         return 0;


=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -151,22 +151,23 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
     if( *size == 0 )
         return NULL;
 
-    if( *in == 0 ) /* Null string stored */
+    size_t len = strnlen( (const char *)*in, *size );
+    if( len == 0 ) /* Null string stored */
     {
         *in += 1;
         *size -= 1;
         return NULL;
     }
 
-    size_t len = strnlen( (const char *)*in, *size );
-    if( len == 0 || len >= *size )
-        return NULL;
-
-    len++;
-
-    char *ret = malloc( len );
+    const bool b_terminated = len < *size;
+    char *ret = malloc( len + 1 );
     if( likely(ret != NULL) )
+    {
         memcpy( ret, *in, len );
+        ret[len] = 0; // ensure termination
+    }
+    if( b_terminated ) // terminated
+        len++;
     *in += len;
     *size -= len;
     return ret;


=====================================
modules/demux/mp4/mp4.c
=====================================
@@ -39,6 +39,7 @@
 #include <vlc_replay_gain.h>
 #include <assert.h>
 #include <limits.h>
+#include <stdckdint.h>
 #include <math.h>
 #include "meta.h"
 #include "attachments.h"
@@ -1520,6 +1521,9 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         /* skip packet constructor */
         p_slice += CONSTRUCTORSIZE;
 
+        if( sample_cons.length == 0 )
+            continue;
+
         /* check that is RTPsampleconstructor, referencing itself and no weird audio stuff */
         if( sample_cons.type != 2||sample_cons.trackrefindex != -1
             ||sample_cons.samplesperblock != 1||sample_cons.bytesperblock != 1 )
@@ -1529,15 +1533,24 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         }
 
         /* slice doesn't fit in buffer */
-        if( sample_cons.sampleoffset + sample_cons.length > p_block->i_buffer)
+        size_t slice_size;
+        if( ckd_add( &slice_size, sample_cons.sampleoffset, sample_cons.length ) ||
+            slice_size > p_block->i_buffer )
         {
             msg_Err(p_demux, "Sample buffer is smaller than sample" );
             goto error;
         }
 
+        size_t realloc_size;
+        if( ckd_add( &realloc_size, i_payload, sample_cons.length ) ||
+            ckd_add( &realloc_size, realloc_size, 4 ) )
+        {
+            goto error;
+        }
+
         block_t *p_realloc = ( p_newblock ) ?
-                             block_Realloc( p_newblock, 0, i_payload + sample_cons.length + 4 ):
-                             block_Alloc( i_payload + sample_cons.length + 4 );
+                             block_TryRealloc( p_newblock, 0, realloc_size ):
+                             block_Alloc( realloc_size );
         if( !p_realloc )
             goto error;
 
@@ -1548,7 +1561,7 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         uint8_t i_type = (*p_src) & ((1<<5)-1);
 
         const uint8_t synccode[4] = { 0, 0, 0, 1 };
-        if( memcmp( p_src, synccode, 4 ) )
+        if( sample_cons.length < 4 || memcmp( p_src, synccode, 4 ) )
         {
             if( i_type == 7 || i_type == 8 )
                 *p_dst++=0;
@@ -1595,6 +1608,7 @@ static block_t * MP4_RTPHint_Convert( demux_t *p_demux, block_t *p_block, vlc_fo
         if( i_packets == 1 && i_skip < p_block->i_buffer )
         {
             p_block->p_buffer += i_skip;
+            p_block->i_buffer -= i_skip;
             p_converted = p_block;
         }
         else
@@ -3904,13 +3918,14 @@ static void MP4_TrackSetup( demux_t *p_demux, mp4_track_t *p_track,
             MP4_Box_t *p_sdp;
 
             /* parse the sdp message to find out whether the RTP stream contained audio or video */
-            if( !( p_sdp  = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) )
+            if( !( p_sdp  = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) ||
+                !BOXDATA(p_sdp)->psz_text )
             {
                 msg_Warn( p_demux, "Didn't find sdp box to determine stream type" );
                 return;
             }
 
-            memcpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
+            strncpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
             if( !strcmp(sdp_media_type, "m=audio") )
             {
                 msg_Dbg( p_demux, "Found audio Rtp: %s", sdp_media_type );



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/903ff61665479c3901e2438c572488ed7c85498e...87e08036c537b2802ad7887587af0d88331bdaa7

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/903ff61665479c3901e2438c572488ed7c85498e...87e08036c537b2802ad7887587af0d88331bdaa7
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help




More information about the vlc-commits mailing list