rtmp: Allow having more unknown data at the end of a chunk size packet without failing

[ffmpeg] / libavformat / rtmpproto.c

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 5aa6a540c5b2f59553d088ad58fad07f638840fa..4e5eddb69a41faf14f1051244279234f8c8c6f99 100644 (file)
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -885,9 +885,9 @@ static int handle_chunk_size(URLContext *s, RTMPPacket *pkt)
     RTMPContext *rt = s->priv_data;
     int ret;
 
-    if (pkt->data_size != 4) {
+    if (pkt->data_size < 4) {
         av_log(s, AV_LOG_ERROR,
-               "Chunk size change packet is not 4 bytes long (%d)\n",
+               "Too short chunk size change packet (%d)\n",
                pkt->data_size);
         return AVERROR_INVALIDDATA;
     }
@@ -930,10 +930,18 @@ static int handle_client_bw(URLContext *s, RTMPPacket *pkt)
         av_log(s, AV_LOG_ERROR,
                "Client bandwidth report packet is less than 4 bytes long (%d)\n",
                pkt->data_size);
-        return -1;
+        return AVERROR_INVALIDDATA;
+    }
+
+    rt->client_report_size = AV_RB32(pkt->data);
+    if (rt->client_report_size <= 0) {
+        av_log(s, AV_LOG_ERROR, "Incorrect client bandwidth %d\n",
+                rt->client_report_size);
+        return AVERROR_INVALIDDATA;
+
     }
-    av_log(s, AV_LOG_DEBUG, "Client bandwidth = %d\n", AV_RB32(pkt->data));
-    rt->client_report_size = AV_RB32(pkt->data) >> 1;
+    av_log(s, AV_LOG_DEBUG, "Client bandwidth = %d\n", rt->client_report_size);
+    rt->client_report_size >>= 1;
 
     return 0;
 }
@@ -942,11 +950,18 @@ static int handle_server_bw(URLContext *s, RTMPPacket *pkt)
 {
     RTMPContext *rt = s->priv_data;
 
+    if (pkt->data_size < 4) {
+        av_log(s, AV_LOG_ERROR,
+               "Too short server bandwidth report packet (%d)\n",
+               pkt->data_size);
+        return AVERROR_INVALIDDATA;
+    }
+
     rt->server_bw = AV_RB32(pkt->data);
     if (rt->server_bw <= 0) {
         av_log(s, AV_LOG_ERROR, "Incorrect server bandwidth %d\n",
                rt->server_bw);
-        return AVERROR(EINVAL);
+        return AVERROR_INVALIDDATA;
     }
     av_log(s, AV_LOG_DEBUG, "Server bandwidth = %d\n", rt->server_bw);