[vlc-commits] [Git][videolan/vlc][3.0.x] 9 commits: demux: mp4: ignore empty reconstructed RTP packets

Jean-Baptiste Kempf (@jbk) gitlab at videolan.org
Wed Jul 29 18:31:15 UTC 2026



Jean-Baptiste Kempf pushed to branch 3.0.x at VideoLAN / VLC


Commits:
0b0ce146 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: ignore empty reconstructed RTP packets

(cherry picked from commit 2a973e0a1b00e17605d7c65d5322b2d7d7e3c969)

- - - - -
1f1d67dd by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate RTP sample ranges

fixes #29979
Reported-by: HE WEI (ギカク) <skyexpoc at gmail.com>

(adapted from commit e744e728493e780011eaa8654f6fc0501f7e546f)

- - - - -
f9aa389a by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: keep RTP buffer accounting consistent

(cherry picked from commit 3cd7824fcd31a37c4520e3224d7c44edcd181df7)

- - - - -
3b3f4425 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: simplify RTP payload ownership

(cherry picked from commit 6db4ecb02d9b3065d193d69bd8d8c0c5493cad29)

- - - - -
47d91f41 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: libmp4: fix zero length strings reading

(cherry picked from commit 10fac2e6487ea48f7503cda96336c5e0f1481837)

- - - - -
26a0bd28 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: handle non terminated strings

regression by e018cc44508a62b381a5cbf256693a970cdc20b0

(cherry picked from commit a4d89aaca7f5058673dd2ee6404ea12c10ce1fcc)

- - - - -
3378a0e8 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate SDP text fields

(adapted from commit 2e8207db335e488712607fcd46f466c7bd06db1e)

- - - - -
f40d13fe by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: handle missing SDP fields

(cherry picked from commit 52b1b88109ea5632a05a689864ab22703e90b775)

- - - - -
dd019055 by François Cartegnie at 2026-07-29T17:15:38+02:00
demux: mp4: validate minimum RTP payload size

(cherry picked from commit 87e08036c537b2802ad7887587af0d88331bdaa7)

- - - - -


3 changed files:

- modules/demux/mp4/essetup.c
- modules/demux/mp4/libmp4.c
- modules/demux/mp4/mp4.c


Changes:

=====================================
modules/demux/mp4/essetup.c
=====================================
@@ -114,12 +114,12 @@ static int SetupRTPReceptionHintTrack( demux_t *p_demux, mp4_track_t *p_track, M
 {
     p_track->fmt.i_original_fourcc = p_sample->i_type;
 
-    if( !p_track->p_sdp )
+    const MP4_Box_t *p_sdp = p_track->p_sdp;
+    if( !p_sdp || !BOXDATA(p_sdp)->psz_text )
     {
         msg_Err(p_demux, "Required 'sdp '-box not found");
         return 0;
     }
-    MP4_Box_t *p_sdp = p_track->p_sdp;
     char *strtok_state;
     char * pch = strtok_r(BOXDATA(p_sdp)->psz_text, " =\n", &strtok_state); /* media entry */
     if( pch && pch[0] != 'm' )


=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -91,15 +91,26 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
 {
     assert( *size <= SSIZE_MAX );
 
-    size_t len = strnlen( (const char *)*in, *size );
-    if( len == 0 || len >= *size )
+    if( *size == 0 )
         return NULL;
 
-    len++;
+    size_t len = strnlen( (const char *)*in, *size );
+    if( len == 0 ) /* Null string stored */
+    {
+        *in += 1;
+        *size -= 1;
+        return NULL;
+    }
 
-    char *ret = malloc( len );
+    const bool b_terminated = len < *size;
+    char *ret = malloc( len + 1 );
     if( likely(ret != NULL) )
+    {
         memcpy( ret, *in, len );
+        ret[len] = 0; // ensure termination
+    }
+    if( b_terminated ) // terminated
+        len++;
     *in += len;
     *size -= len;
     return ret;


=====================================
modules/demux/mp4/mp4.c
=====================================
@@ -37,6 +37,7 @@
 #include <vlc_dialog.h>
 #include <assert.h>
 #include <limits.h>
+#include <stdckdint.h>
 #include "../codec/cc.h"
 #include "../av1_unpack.h"
 
@@ -1203,6 +1204,9 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         /* skip packet constructor */
         p_slice += CONSTRUCTORSIZE;
 
+        if( sample_cons.length == 0 )
+            continue;
+
         /* check that is RTPsampleconstructor, referencing itself and no weird audio stuff */
         if( sample_cons.type != 2||sample_cons.trackrefindex != -1
             ||sample_cons.samplesperblock != 1||sample_cons.bytesperblock != 1 )
@@ -1212,15 +1216,24 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         }
 
         /* slice doesn't fit in buffer */
-        if( sample_cons.sampleoffset + sample_cons.length > p_block->i_buffer)
+        size_t slice_size;
+        if( ckd_add( &slice_size, sample_cons.sampleoffset, sample_cons.length ) ||
+            slice_size > p_block->i_buffer )
         {
             msg_Err(p_demux, "Sample buffer is smaller than sample" );
             goto error;
         }
 
+        size_t realloc_size;
+        if( ckd_add( &realloc_size, i_payload, sample_cons.length ) ||
+            ckd_add( &realloc_size, realloc_size, 4 ) )
+        {
+            goto error;
+        }
+
         block_t *p_realloc = ( p_newblock ) ?
-                             block_Realloc( p_newblock, 0, i_payload + sample_cons.length + 4 ):
-                             block_Alloc( i_payload + sample_cons.length + 4 );
+                             block_TryRealloc( p_newblock, 0, realloc_size ):
+                             block_Alloc( realloc_size );
         if( !p_realloc )
             goto error;
 
@@ -1231,7 +1244,7 @@ static block_t * MP4_RTPHintToFrame( demux_t *p_demux, block_t *p_block, uint32_
         uint8_t i_type = (*p_src) & ((1<<5)-1);
 
         const uint8_t synccode[4] = { 0, 0, 0, 1 };
-        if( memcmp( p_src, synccode, 4 ) )
+        if( sample_cons.length < 4 || memcmp( p_src, synccode, 4 ) )
         {
             if( i_type == 7 || i_type == 8 )
                 *p_dst++=0;
@@ -1278,6 +1291,7 @@ static block_t * MP4_RTPHint_Convert( demux_t *p_demux, block_t *p_block, vlc_fo
         if( i_packets == 1 && i_skip < p_block->i_buffer )
         {
             p_block->p_buffer += i_skip;
+            p_block->i_buffer -= i_skip;
             p_converted = p_block;
         }
         else
@@ -3427,13 +3441,14 @@ static void MP4_TrackSetup( demux_t *p_demux, mp4_track_t *p_track,
             MP4_Box_t *p_sdp;
 
             /* parse the sdp message to find out whether the RTP stream contained audio or video */
-            if( !( p_sdp  = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) )
+            if( !( p_sdp  = MP4_BoxGet( p_box_trak, "udta/hnti/sdp " ) ) ||
+                !BOXDATA(p_sdp)->psz_text )
             {
                 msg_Warn( p_demux, "Didn't find sdp box to determine stream type" );
                 return;
             }
 
-            memcpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
+            strncpy( sdp_media_type, BOXDATA(p_sdp)->psz_text, 7 );
             if( !strcmp(sdp_media_type, "m=audio") )
             {
                 msg_Dbg( p_demux, "Found audio Rtp: %s", sdp_media_type );



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/67ccb11cc8293aeb04e781d90c2e00d5a2843c70...dd019055356cd69e57177bf30c1ee676fec7b763

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/67ccb11cc8293aeb04e781d90c2e00d5a2843c70...dd019055356cd69e57177bf30c1ee676fec7b763
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help




More information about the vlc-commits mailing list