comparison libmpdemux/asf_mmst_streaming.c @ 14163:dd835e8f3698

fix a problem pointed out by iDEFENSE and several similar ones.
author reimar
date Wed, 15 Dec 2004 19:12:46 +0000
parents a0bb374553a1
children 4a6b79a1ad52
comparison
equal deleted inserted replaced
14162:5f24743d1fb8 14163:dd835e8f3698
40 #include "stream.h" 40 #include "stream.h"
41 41
42 #include "network.h" 42 #include "network.h"
43 43
44 #define BUF_SIZE 102400 44 #define BUF_SIZE 102400
45 #define HDR_BUF_SIZE 8192
45 46
46 typedef struct 47 typedef struct
47 { 48 {
48 uint8_t buf[BUF_SIZE]; 49 uint8_t buf[BUF_SIZE];
49 int num_bytes; 50 int num_bytes;
214 215
215 packet_len = (pre_header[7] << 8 | pre_header[6]) - 8; 216 packet_len = (pre_header[7] << 8 | pre_header[6]) - 8;
216 217
217 // printf ("asf header packet detected, len=%d\n", packet_len); 218 // printf ("asf header packet detected, len=%d\n", packet_len);
218 219
220 if (packet_len < 0 || packet_len > HDR_BUF_SIZE - header_len) {
221 mp_msg(MSGT_NETWORK, MSGL_FATAL, "Invalid header size, giving up\n");
222 return 0;
223 }
224
219 if (!get_data (s, &header[header_len], packet_len)) { 225 if (!get_data (s, &header[header_len], packet_len)) {
220 printf ("header data read failed\n"); 226 printf ("header data read failed\n");
221 return 0; 227 return 0;
222 } 228 }
223 229
248 } 254 }
249 255
250 packet_len = get_32 ((unsigned char*)&packet_len, 0) + 4; 256 packet_len = get_32 ((unsigned char*)&packet_len, 0) + 4;
251 257
252 // printf ("command packet detected, len=%d\n", packet_len); 258 // printf ("command packet detected, len=%d\n", packet_len);
259
260 if (packet_len < 0 || packet_len > BUF_SIZE) {
261 mp_msg(MSGT_NETWORK, MSGL_FATAL,
262 "Invalid rtsp packet size, giving up\n");
263 return 0;
264 }
253 265
254 if (!get_data (s, data, packet_len)) { 266 if (!get_data (s, data, packet_len)) {
255 printf ("command data read failed\n"); 267 printf ("command data read failed\n");
256 return 0; 268 return 0;
257 } 269 }
359 371
360 packet_len = (pre_header[7] << 8 | pre_header[6]) - 8; 372 packet_len = (pre_header[7] << 8 | pre_header[6]) - 8;
361 373
362 // printf ("asf media packet detected, len=%d\n", packet_len); 374 // printf ("asf media packet detected, len=%d\n", packet_len);
363 375
376 if (packet_len < 0 || packet_len > BUF_SIZE) {
377 mp_msg(MSGT_NETWORK, MSGL_FATAL,
378 "Invalid rtsp packet size, giving up\n");
379 return 0;
380 }
381
364 if (!get_data (s, data, packet_len)) { 382 if (!get_data (s, data, packet_len)) {
365 printf ("media data read failed\n"); 383 printf ("media data read failed\n");
366 return 0; 384 return 0;
367 } 385 }
368 386
377 printf ("packet_len read failed\n"); 395 printf ("packet_len read failed\n");
378 return 0; 396 return 0;
379 } 397 }
380 398
381 packet_len = get_32 ((unsigned char*)&packet_len, 0) + 4; 399 packet_len = get_32 ((unsigned char*)&packet_len, 0) + 4;
400
401 if (packet_len < 0 || packet_len > BUF_SIZE) {
402 mp_msg(MSGT_NETWORK, MSGL_FATAL,
403 "Invalid rtsp packet size, giving up\n");
404 return 0;
405 }
382 406
383 if (!get_data (s, data, packet_len)) { 407 if (!get_data (s, data, packet_len)) {
384 printf ("command data read failed\n"); 408 printf ("command data read failed\n");
385 return 0; 409 return 0;
386 } 410 }
462 486
463 int asf_mmst_streaming_start(stream_t *stream) 487 int asf_mmst_streaming_start(stream_t *stream)
464 { 488 {
465 char str[1024]; 489 char str[1024];
466 char data[BUF_SIZE]; 490 char data[BUF_SIZE];
467 uint8_t asf_header[8192]; 491 uint8_t asf_header[HDR_BUF_SIZE];
468 int asf_header_len; 492 int asf_header_len;
469 int len, i, packet_length; 493 int len, i, packet_length;
470 char *path, *unescpath; 494 char *path, *unescpath;
471 URL_t *url1 = stream->streaming_ctrl->url; 495 URL_t *url1 = stream->streaming_ctrl->url;
472 int s = stream->fd; 496 int s = stream->fd;