mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-23 18:21:04 +00:00
Code Issues 1 Projects Releases Wiki Activity

rtp: Fix segmentation fault processing payload buffers

Browse source 
This commit checks if the value returned by
gst_rtp_buffer_get_payload_buffer and
gst_rtp_buffer_get_payload_subbuffer is NULL before using it.
This commit is contained in:
Jose Antonio Santos Cadenas 2011-05-18 12:36:40 +02:00 committed by Sebastian Dröge
parent 23ecab67d6
commit 9d32243671
12 changed files with 43 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
gst/rtp/gstrtpac3depay.c
View file

@ -193,8 +193,9 @@ gst_rtp_ac3_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* We don't bother with fragmented packets yet */ /* We don't bother with fragmented packets yet */
outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, 2, -1); outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, 2, -1);
GST_DEBUG_OBJECT (rtpac3depay, "pushing buffer of size %d", if (outbuf)
GST_BUFFER_SIZE (outbuf)); GST_DEBUG_OBJECT (rtpac3depay, "pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf));
return outbuf; return outbuf;
} }

2
gst/rtp/gstrtpbvdepay.c
View file

@ -165,7 +165,7 @@ gst_rtp_bv_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

2
gst/rtp/gstrtpg722depay.c
View file

@ -236,7 +236,7 @@ gst_rtp_g722_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
marker = gst_rtp_buffer_get_marker (buf); marker = gst_rtp_buffer_get_marker (buf);
if (marker) { if (marker && outbuf) {
/* mark talk spurt with DISCONT */ /* mark talk spurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

9
gst/rtp/gstrtpg726depay.c
View file

@ -222,6 +222,8 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
if (depay->aal2 || depay->force_aal2) { if (depay->aal2 || depay->force_aal2) {
/* AAL2, we can just copy the bytes */ /* AAL2, we can just copy the bytes */
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (!outbuf)
goto bad_len;
} else { } else {
guint8 *in, *out, tmp; guint8 *in, *out, tmp;
guint len; guint len;
@ -239,6 +241,10 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (copy); outbuf = gst_rtp_buffer_get_payload_buffer (copy);
gst_buffer_unref (copy); gst_buffer_unref (copy);
} }
if (!outbuf)
goto bad_len;
out = GST_BUFFER_DATA (outbuf); out = GST_BUFFER_DATA (outbuf);
/* we need to reshuffle the bytes, input is always of the form /* we need to reshuffle the bytes, input is always of the form
@ -335,6 +341,9 @@ gst_rtp_g726_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
} }
return outbuf; return outbuf;
bad_len:
return NULL;
} }
static void static void

2
gst/rtp/gstrtpgsmdepay.c
View file

@ -136,7 +136,7 @@ gst_rtp_gsm_depay_process (GstBaseRTPDepayload * _depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

2
gst/rtp/gstrtpilbcdepay.c
View file

@ -188,7 +188,7 @@ gst_rtp_ilbc_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
if (marker) { if (marker && outbuf) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
} }

5
gst/rtp/gstrtpmp1sdepay.c
View file

@ -131,8 +131,9 @@ gst_rtp_mp1s_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
GST_DEBUG ("gst_rtp_mp1s_depay_chain: pushing buffer of size %d", if (outbuf)
GST_BUFFER_SIZE (outbuf)); GST_DEBUG ("gst_rtp_mp1s_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf));
return outbuf; return outbuf;
} }

5
gst/rtp/gstrtpmp2tdepay.c
View file

@ -169,8 +169,9 @@ gst_rtp_mp2t_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
gst_rtp_buffer_get_payload_subbuffer (buf, rtpmp2tdepay->skip_first_bytes, gst_rtp_buffer_get_payload_subbuffer (buf, rtpmp2tdepay->skip_first_bytes,
-1); -1);
GST_DEBUG ("gst_rtp_mp2t_depay_chain: pushing buffer of size %d", if (outbuf)
GST_BUFFER_SIZE (outbuf)); GST_DEBUG ("gst_rtp_mp2t_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf));
return outbuf; return outbuf;

8
gst/rtp/gstrtpmpvdepay.c
View file

@ -176,9 +176,11 @@ gst_rtp_mpv_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, payload_header, -1); outbuf = gst_rtp_buffer_get_payload_subbuffer (buf, payload_header, -1);
GST_DEBUG_OBJECT (rtpmpvdepay, if (outbuf) {
"gst_rtp_mpv_depay_chain: pushing buffer of size %d", GST_DEBUG_OBJECT (rtpmpvdepay,
GST_BUFFER_SIZE (outbuf)); "gst_rtp_mpv_depay_chain: pushing buffer of size %d",
GST_BUFFER_SIZE (outbuf));
}
return outbuf; return outbuf;
} }

12
gst/rtp/gstrtppcmadepay.c
View file

@ -143,12 +143,14 @@ gst_rtp_pcma_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
len = gst_rtp_buffer_get_payload_len (buf); len = gst_rtp_buffer_get_payload_len (buf);
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
GST_BUFFER_DURATION (outbuf) = if (outbuf) {
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate); GST_BUFFER_DURATION (outbuf) =
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate);
if (marker) { if (marker) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
}
} }
return outbuf; return outbuf;

12
gst/rtp/gstrtppcmudepay.c
View file

@ -143,12 +143,14 @@ gst_rtp_pcmu_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
len = gst_rtp_buffer_get_payload_len (buf); len = gst_rtp_buffer_get_payload_len (buf);
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
GST_BUFFER_DURATION (outbuf) = if (outbuf) {
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate); GST_BUFFER_DURATION (outbuf) =
gst_util_uint64_scale_int (len, GST_SECOND, depayload->clock_rate);
if (marker) { if (marker) {
/* mark start of talkspurt with DISCONT */ /* mark start of talkspurt with DISCONT */
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT); GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DISCONT);
}
} }
return outbuf; return outbuf;

3
gst/rtp/gstrtpspeexdepay.c
View file

@ -212,7 +212,8 @@ gst_rtp_speex_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
/* nothing special to be done */ /* nothing special to be done */
outbuf = gst_rtp_buffer_get_payload_buffer (buf); outbuf = gst_rtp_buffer_get_payload_buffer (buf);
GST_BUFFER_DURATION (outbuf) = 20 * GST_MSECOND; if (outbuf)
GST_BUFFER_DURATION (outbuf) = 20 * GST_MSECOND;
return outbuf; return outbuf;
} }