rtp: Fix segmentation fault processing payload buffers

This commit checks if the value returned by
gst_rtp_buffer_get_payload_buffer and
gst_rtp_buffer_get_payload_subbuffer is NULL before using it.
This commit is contained in:
Jose Antonio Santos Cadenas 2011-05-18 12:36:40 +02:00 committed by Tim-Philipp Müller
parent e4f7411b57
commit 1f6af8a815
12 changed files with 43 additions and 24 deletions

View file

@ -193,6 +193,7 @@ gst_rtp_ac3_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* We don't bother with fragmented packets yet */ /* We don't bother with fragmented packets yet */
outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, 2, -1); outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, 2, -1);
if (outbuf)
GST_DEBUG_OBJECT (rtpac3depay, "pushing buffer of size %d", GST_DEBUG_OBJECT (rtpac3depay, "pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf)); GST_BUFFER_SIZE (outbuf));

View file

@ -165,7 +165,7 @@ gst_rtp_bv_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

View file

@ -236,7 +236,7 @@ gst_rtp_g722_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
marker = gst_rtp_buffer_get_marker (buf); marker = gst_rtp_buffer_get_marker (buf);
if (marker) { if (marker && outbuf) {
/* mark talk spurt with DISCONT */ /* mark talk spurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

View file

@ -222,6 +222,8 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
if (depay->aal2 || depay->force_aal2) { if (depay->aal2 || depay->force_aal2) {
/* AAL2, we can just copy the bytes */ /* AAL2, we can just copy the bytes */
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (!outbuf)
goto bad_len;
} else { } else {
guint8 *in, *out, tmp; guint8 *in, *out, tmp;
guint len; guint len;
@ -239,6 +241,10 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (copy); outbuf = gst_rtp_buffer_get_payload_buffer (copy);
gst_buffer_unref (copy); gst_buffer_unref (copy);
} }
if (!outbuf)
goto bad_len;
out = GST_BUFFER_DATA (outbuf); out = GST_BUFFER_DATA (outbuf);
/* we need to reshuffle the bytes, input is always of the form /* we need to reshuffle the bytes, input is always of the form
@ -335,6 +341,9 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
} }
return outbuf; return outbuf;
bad_len:
return NULL;
} }
static void static void

View file

@ -136,7 +136,7 @@ gst_rtp_gsm_depay_process (GstBaseRTPDepayload * _depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

View file

@ -188,7 +188,7 @@ gst_rtp_ilbc_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

View file

@ -131,6 +131,7 @@ gst_rtp_mp1s_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (outbuf)
GST_DEBUG ("gst_rtp_mp1s_depay_chain: pushing buffer of size %d", GST_DEBUG ("gst_rtp_mp1s_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf)); GST_BUFFER_SIZE (outbuf));

View file

@ -169,6 +169,7 @@ gst_rtp_mp2t_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
gst_rtp_buffer_get_payload_subbuffer (buf, rtpmp2tdepay->skip_first_bytes, gst_rtp_buffer_get_payload_subbuffer (buf, rtpmp2tdepay->skip_first_bytes,
-1); -1);
if (outbuf)
GST_DEBUG ("gst_rtp_mp2t_depay_chain: pushing buffer of size %d", GST_DEBUG ("gst_rtp_mp2t_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf)); GST_BUFFER_SIZE (outbuf));

View file

@ -176,9 +176,11 @@ gst_rtp_mpv_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, payload_header, -1); outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, payload_header, -1);
if (outbuf) {
GST_DEBUG_OBJECT (rtpmpvdepay, GST_DEBUG_OBJECT (rtpmpvdepay,
"gst_rtp_mpv_depay_chain: pushing buffer of size %d", "gst_rtp_mpv_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf)); GST_BUFFER_SIZE (outbuf));
}
return outbuf; return outbuf;
} }

View file

@ -143,6 +143,7 @@ gst_rtp_pcma_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
len = gst_rtp_buffer_get_payload_len (buf); len = gst_rtp_buffer_get_payload_len (buf);
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (outbuf) {
GST_BUFFER_DURATION (outbuf) = GST_BUFFER_DURATION (outbuf) =
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate); gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate);
@ -150,6 +151,7 @@ gst_rtp_pcma_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }
}
return outbuf; return outbuf;
} }

View file

@ -143,6 +143,7 @@ gst_rtp_pcmu_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
len = gst_rtp_buffer_get_payload_len (buf); len = gst_rtp_buffer_get_payload_len (buf);
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (outbuf) {
GST_BUFFER_DURATION (outbuf) = GST_BUFFER_DURATION (outbuf) =
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate); gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate);
@ -150,6 +151,7 @@ gst_rtp_pcmu_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }
}
return outbuf; return outbuf;
} }

View file

@ -212,6 +212,7 @@ gst_rtp_speex_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* nothing special to be done */ /* nothing special to be done */
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (outbuf)
GST_BUFFER_DURATION (outbuf) = 20 * GST_MSECOND; GST_BUFFER_DURATION (outbuf) = 20 * GST_MSECOND;
return outbuf; return outbuf;