This allows skipping past unsupported RTCP packet types, as RFC 3550 section 6.1 mandates. Currently this only has any practical effect if a sender puts an unrecognized type before RTCP_BYE in a compounded packet, or (incorrectly) does not put RTCP_SR first.
Unified · Split
| @@ -112,14 +112,15 @@ RTPDynamicProtocolHandler *ff_rtp_handler_find_by_id(int id, · 111 unmodified lines | |||
| 112 | static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len) | 112 | static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len) |
| 113 | { | 113 | { |
| 114 | int payload_len; | 114 | int payload_len; |
| 115 | while (len >= 2) { | 115 | while (len >= 4) { |
| 116 | payload_len = FFMIN(len, (AV_RB16(buf + 2) + 1) * 4); | ||
| 117 | |||
| 116 | switch (buf[1]) { | 118 | switch (buf[1]) { |
| 117 | case RTCP_SR: | 119 | case RTCP_SR: |
| 118 | if (len < 20) { | 120 | if (payload_len < 20) { |
| 119 | av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n"); | 121 | av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n"); |
| 120 | return AVERROR_INVALIDDATA; | 122 | return AVERROR_INVALIDDATA; |
| 121 | } | 123 | } |
| 122 | payload_len = (AV_RB16(buf + 2) + 1) * 4; | ||
| 123 | 124 | ||
| 124 | s->last_rtcp_ntp_time = AV_RB64(buf + 8); | 125 | s->last_rtcp_ntp_time = AV_RB64(buf + 8); |
| 125 | s->last_rtcp_timestamp = AV_RB32(buf + 16); | 126 | s->last_rtcp_timestamp = AV_RB32(buf + 16); |
| @@ -130,14 +131,13 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int l · 4 unmodified lines | |||
| 130 | s->rtcp_ts_offset = s->last_rtcp_timestamp - s->base_timestamp; | 131 | s->rtcp_ts_offset = s->last_rtcp_timestamp - s->base_timestamp; |
| 131 | } | 132 | } |
| 132 | 133 | ||
| 133 | buf += payload_len; | ||
| 134 | len -= payload_len; | ||
| 135 | break; | 134 | break; |
| 136 | case RTCP_BYE: | 135 | case RTCP_BYE: |
| 137 | return -RTCP_BYE; | 136 | return -RTCP_BYE; |
| 138 | default: | ||
| 139 | return -1; | ||
| 140 | } | 137 | } |
| 138 | |||
| 139 | buf += payload_len; | ||
| 140 | len -= payload_len; | ||
| 141 | } | 141 | } |
| 142 | return -1; | 142 | return -1; |
| 143 | } | 143 | } |