rtspdec: Fix use of uninitialized byte

[ffmpeg] / libavformat / rtpenc_h264.c

diff --git a/libavformat/rtpenc_h264.c b/libavformat/rtpenc_h264.c
index 9ca6f7f68ebc128616fae428e08f23ae6c4ef4f7..ac740743078f3a0a972d799bbb1388b6bc8a835c 100644 (file)
--- a/libavformat/rtpenc_h264.c
+++ b/libavformat/rtpenc_h264.c
@@ -29,6 +29,21 @@
 #include "avc.h"
 #include "rtpenc.h"
 
+static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t *end, int nal_length_size)
+{
+    int res = 0;
+
+    if (end - start < nal_length_size)
+        return NULL;
+    while (nal_length_size--)
+        res = (res << 8) | *start++;
+
+    if (start + res > end || res < 0 || start + res < start)
+        return NULL;
+
+    return start + res;
+}
+
 static void nal_send(AVFormatContext *s1, const uint8_t *buf, int size, int last)
 {
     RTPMuxContext *s = s1->priv_data;
@@ -40,6 +55,12 @@ static void nal_send(AVFormatContext *s1, const uint8_t *buf, int size, int last
         uint8_t type = buf[0] & 0x1F;
         uint8_t nri = buf[0] & 0x60;
 
+        if (s->flags & FF_RTP_FLAG_H264_MODE0) {
+            av_log(s1, AV_LOG_ERROR,
+                   "NAL size %d > %d, try -slice-max-size %d\n", size,
+                   s->max_payload_size, s->max_payload_size);
+            return;
+        }
         av_log(s1, AV_LOG_DEBUG, "NAL size %d > %d\n", size, s->max_payload_size);
         s->buf[0] = 28;        /* FU Indicator; Type = 28 ---> FU-A */
         s->buf[0] |= nri;
@@ -62,17 +83,27 @@ static void nal_send(AVFormatContext *s1, const uint8_t *buf, int size, int last
 
 void ff_rtp_send_h264(AVFormatContext *s1, const uint8_t *buf1, int size)
 {
-    const uint8_t *r;
+    const uint8_t *r, *end = buf1 + size;
     RTPMuxContext *s = s1->priv_data;
 
     s->timestamp = s->cur_timestamp;
-    r = ff_avc_find_startcode(buf1, buf1 + size);
-    while (r < buf1 + size) {
+    if (s->nal_length_size)
+        r = avc_mp4_find_startcode(buf1, end, s->nal_length_size) ? buf1 : end;
+    else
+        r = ff_avc_find_startcode(buf1, end);
+    while (r < end) {
         const uint8_t *r1;
 
-        while(!*(r++));
-        r1 = ff_avc_find_startcode(r, buf1 + size);
-        nal_send(s1, r, r1 - r, (r1 == buf1 + size));
+        if (s->nal_length_size) {
+            r1 = avc_mp4_find_startcode(r, end, s->nal_length_size);
+            if (!r1)
+                r1 = end;
+            r += s->nal_length_size;
+        } else {
+            while (!*(r++));
+            r1 = ff_avc_find_startcode(r, end);
+        }
+        nal_send(s1, r, r1 - r, r1 == end);
         r = r1;
     }
 }