[vlc-commits] [Git][videolan/vlc][3.0.x] 9 commits: demux: mp4: ignore empty reconstructed RTP packets
Jean-Baptiste Kempf (@jbk)
gitlab at videolan.org
Wed Jul 29 18:31:15 UTC 2026
Jean-Baptiste Kempf pushed to branch 3.0.x at VideoLAN / VLC
Commits:
0b0ce146 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: ignore empty reconstructed RTP packets
(cherry picked from commit 2a973e0a1b00e17605d7c65d5322b2d7d7e3c969)
- - - - -
1f1d67dd by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate RTP sample ranges
fixes #29979
Reported-by: HE WEI (ギカク) <skyexpoc at gmail.com>
(adapted from commit e744e728493e780011eaa8654f6fc0501f7e546f)
- - - - -
f9aa389a by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: keep RTP buffer accounting consistent
(cherry picked from commit 3cd7824fcd31a37c4520e3224d7c44edcd181df7)
- - - - -
3b3f4425 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: simplify RTP payload ownership
(cherry picked from commit 6db4ecb02d9b3065d193d69bd8d8c0c5493cad29)
- - - - -
47d91f41 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: libmp4: fix zero length strings reading
(cherry picked from commit 10fac2e6487ea48f7503cda96336c5e0f1481837)
- - - - -
26a0bd28 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: handle non terminated strings
regression by e018cc44508a62b381a5cbf256693a970cdc20b0
(cherry picked from commit a4d89aaca7f5058673dd2ee6404ea12c10ce1fcc)
- - - - -
3378a0e8 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate SDP text fields
(adapted from commit 2e8207db335e488712607fcd46f466c7bd06db1e)
- - - - -
f40d13fe by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: handle missing SDP fields
(cherry picked from commit 52b1b88109ea5632a05a689864ab22703e90b775)
- - - - -
dd019055 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate minimum RTP payload size
(cherry picked from commit 87e08036c537b2802ad7887587af0d88331bdaa7)
- - - - -
3 changed files:
- modules/demux/mp4/essetup.c
- modules/demux/mp4/libmp4.c
- modules/demux/mp4/mp4.c
Changes:
=====================================
modules/demux/mp4/essetup.c
=====================================
@@ -114,12 +114,12 @@ static int SetupRTPReceptionHintTrack( demux_t *p_demux, mp4_track_t *p_track, M
{
p_track->fmt.i_original_fourcc = p_sample->i_type;
- if( !p_track->p_sdp )
+ const MP4_Box_t *p_sdp = p_track->p_sdp;
+ if( !p_sdp || !BOXDATA(p_sdp)->psz_text )
{
msg_Err(p_demux, "Required 'sdp '-box not found");
return 0;
}
- MP4_Box_t *p_sdp = p_track->p_sdp;
char *strtok_state;
char * pch = strtok_r(BOXDATA(p_sdp)->psz_text, " =\n", &strtok_state); /* media entry */
if( pch && pch[0] != 'm' )
=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -91,15 +91,26 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
{
assert( *size <= SSIZE_MAX );
- size_t len = strnlen( (const char *)*in, *size );
- if( len == 0 || len >= *size )
+ if( *size == 0 )
return NULL;
- len++;
+ size_t len = strnlen( (const char *)*in, *size );
+ if( len == 0 ) /* Null string stored */
+ {
+ *in += 1;
+ *size -= 1;
+ return NULL;
+ }
- char *ret = malloc( len );
+ const bool b_terminated = len < *size;
+ char *ret = malloc( len + 1 );
if( likely(ret != NULL) )
+ {
memcpy( ret, *in, len );
+ ret[len] = 0; // ensure termination
+ }
+ if( b_terminated ) // terminated
+ len++;
*in += len;
*size -= len;
return ret;
=====================================
modules/demux/mp4/mp4.c
=====================================
@@ -37,6 +37,7 @@
#include <vlc_dialog.h>
#include <assert.h>
#include <limits.h>
+#include <stdckdint.h>
#include "../codec/cc.h"
#include "../av1_unpack.h"
@@ -1203,6 +1204,9 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
/* skip packet constructor */
p_slice += CONSTRUCTORSIZE;
+ if( sample_cons.length == 0 )
+ continue;
+
/* check that is RTPsampleconstructor, referencing itself and no weird audio stuff */
if( sample_cons.type != 2||sample_cons.trackrefindex != -1
||sample_cons.samplesperblock != 1||sample_cons.bytesperblock != 1 )
@@ -1212,15 +1216,24 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
}
/* slice doesn't fit in buffer */
- if( sample_cons.sampleoffset + sample_cons.length > p_block->i_buffer)
+ size_t slice_size;
+ if( ckd_add( &slice_size, sample_cons.sampleoffset, sample_cons.length ) ||
+ slice_size > p_block->i_buffer )
{
msg_Err(p_demux, "Sample buffer is smaller than sample" );
goto error;
}
+ size_t realloc_size;
+ if( ckd_add( &realloc_size, i_payload, sample_cons.length ) ||
+ ckd_add( &realloc_size, realloc_size, 4 ) )
+ {
+ goto error;
+ }
+
block_t *p_realloc = ( p_newblock ) ?
- block_Realloc( p_newblock, 0, i_payload + sample_cons.length + 4 ):
- block_Alloc( i_payload + sample_cons.length + 4 );
+ block_TryRealloc( p_newblock, 0, realloc_size ):
+ block_Alloc( realloc_size );
if( !p_realloc )
goto error;
@@ -1231,7 +1244,7 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
uint8_t i_type = (*p_src) & ((1<<5)-1);
const uint8_t synccode[4] = { 0, 0, 0, 1 };
- if( memcmp( p_src, synccode, 4 ) )
+ if( sample_cons.length < 4 || memcmp( p_src, synccode, 4 ) )
{
if( i_type == 7 || i_type == 8 )
*p_dst++=0;
@@ -1278,6 +1291,7 @@ static block_t * MP4_RTPHint_Convert( demux_t *p_demux, block_t *p_block, vlc_fo
if( i_packets == 1 && i_skip < p_block->i_buffer )
{
p_block->p_buffer += i_skip;
+ p_block->i_buffer -= i_skip;
p_converted = p_block;
}
else
@@ -3427,13 +3441,14 @@ static void MP4_TrackSetup( demux_t *p_demux, mp4_track_t *p_track,
MP4_Box_t *p_sdp;
/* parse the sdp message to find out whether the RTP stream contained audio or video */
- if( !( p_sdp = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) )
+ if( !( p_sdp = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) ||
+ !BOXDATA(p_sdp)->psz_text )
{
msg_Warn( p_demux, "Didn't find sdp box to determine stream type" );
return;
}
- memcpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
+ strncpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
if( !strcmp(sdp_media_type, "m=audio") )
{
msg_Dbg( p_demux, "Found audio Rtp: %s", sdp_media_type );
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/67ccb11cc8293aeb04e781d90c2e00d5a2843c70...dd019055356cd69e57177bf30c1ee676fec7b763
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/67ccb11cc8293aeb04e781d90c2e00d5a2843c70...dd019055356cd69e57177bf30c1ee676fec7b763
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list