From 037d36f28dcfcb77fc717e6b674793f2c13dff9a Mon Sep 17 00:00:00 2001 From: Guillaume Desmottes Date: Wed, 26 Jun 2024 16:09:26 +0200 Subject: [PATCH] rtmp2: guard against calling gst_amf_node_get_type() with NULL gst_amf_node_get_type() raises a CRITICAL if called with a NULL node. All callers were checking for this except those. Part-of: --- subprojects/gst-plugins-bad/gst/rtmp2/rtmp/amf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/subprojects/gst-plugins-bad/gst/rtmp2/rtmp/amf.c b/subprojects/gst-plugins-bad/gst/rtmp2/rtmp/amf.c index eed8ebf048..3c06158b5a 100644 --- a/subprojects/gst-plugins-bad/gst/rtmp2/rtmp/amf.c +++ b/subprojects/gst-plugins-bad/gst/rtmp2/rtmp/amf.c @@ -903,7 +903,7 @@ gst_amf_node_parse (const guint8 * data, gsize size, guint8 ** endptr) GST_TRACE ("Starting parse with %" G_GSIZE_FORMAT " bytes", parser.size); node = parse_value (&parser); - if (gst_amf_node_get_type (node) == GST_AMF_TYPE_INVALID) { + if (!node || gst_amf_node_get_type (node) == GST_AMF_TYPE_INVALID) { GST_ERROR ("invalid value"); goto out; } @@ -946,13 +946,13 @@ gst_amf_parse_command (const guint8 * data, gsize size, GST_TRACE ("Starting parse with %" G_GSIZE_FORMAT " bytes", parser.size); node1 = parse_value (&parser); - if (gst_amf_node_get_type (node1) != GST_AMF_TYPE_STRING) { + if (!node1 || gst_amf_node_get_type (node1) != GST_AMF_TYPE_STRING) { GST_ERROR ("no command name"); goto out; } node2 = parse_value (&parser); - if (gst_amf_node_get_type (node2) != GST_AMF_TYPE_NUMBER) { + if (!node2 || gst_amf_node_get_type (node2) != GST_AMF_TYPE_NUMBER) { GST_ERROR ("no transaction ID"); goto out; }