X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Frtpenc_jpeg.c;h=a6f2b32df4a8bdd15bf2ffc85e62a79a1b4934de;hb=f85bc147fb87de048ccc5767e186ac59ec0284ef;hp=7ee26c435e7d2667aa21c3b080af37390f980305;hpb=a8ab64d2f70029a87467f75d1412bf6d13664b64;p=ffmpeg

diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c
index 7ee26c435e7..a6f2b32df4a 100644
--- a/libavformat/rtpenc_jpeg.c
+++ b/libavformat/rtpenc_jpeg.c
@@ -21,13 +21,14 @@
 
 #include "libavcodec/bytestream.h"
 #include "libavcodec/mjpeg.h"
+#include "libavcodec/jpegtables.h"
 #include "libavutil/intreadwrite.h"
 #include "rtpenc.h"
 
 void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
 {
     RTPMuxContext *s = s1->priv_data;
-    const uint8_t *qtables = NULL;
+    const uint8_t *qtables[4] = { NULL };
     int nb_qtables = 0;
     uint8_t type;
     uint8_t w, h;
@@ -63,24 +64,50 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
             continue;
 
         if (buf[i + 1] == DQT) {
-            if (buf[i + 4])
+            int tables, j;
+            if (buf[i + 4] & 0xF0)
                 av_log(s1, AV_LOG_WARNING,
                        "Only 8-bit precision is supported.\n");
 
             /* a quantization table is 64 bytes long */
-            nb_qtables = AV_RB16(&buf[i + 2]) / 65;
-            if (i + 4 + nb_qtables * 65 > size) {
+            tables = AV_RB16(&buf[i + 2]) / 65;
+            if (i + 5 + tables * 65 > size) {
                 av_log(s1, AV_LOG_ERROR, "Too short JPEG header. Aborted!\n");
                 return;
             }
+            if (nb_qtables + tables > 4) {
+                av_log(s1, AV_LOG_ERROR, "Invalid number of quantisation tables\n");
+                return;
+            }
 
-            qtables = &buf[i + 4];
+            for (j = 0; j < tables; j++)
+                qtables[nb_qtables + j] = buf + i + 5 + j * 65;
+            nb_qtables += tables;
         } else if (buf[i + 1] == SOF0) {
             if (buf[i + 14] != 17 || buf[i + 17] != 17) {
                 av_log(s1, AV_LOG_ERROR,
                        "Only 1x1 chroma blocks are supported. Aborted!\n");
                 return;
             }
+        } else if (buf[i + 1] == DHT) {
+            if (   AV_RB16(&buf[i + 2]) < 418
+                || i + 420 >= size
+                || buf[i +   4] != 0x00
+                || buf[i +  33] != 0x01
+                || buf[i +  62] != 0x10
+                || buf[i + 241] != 0x11
+                || memcmp(buf + i +   5, avpriv_mjpeg_bits_dc_luminance   + 1, 16)
+                || memcmp(buf + i +  21, avpriv_mjpeg_val_dc, 12)
+                || memcmp(buf + i +  34, avpriv_mjpeg_bits_dc_chrominance + 1, 16)
+                || memcmp(buf + i +  50, avpriv_mjpeg_val_dc, 12)
+                || memcmp(buf + i +  63, avpriv_mjpeg_bits_ac_luminance   + 1, 16)
+                || memcmp(buf + i +  79, avpriv_mjpeg_val_ac_luminance, 162)
+                || memcmp(buf + i + 242, avpriv_mjpeg_bits_ac_chrominance + 1, 16)
+                || memcmp(buf + i + 258, avpriv_mjpeg_val_ac_chrominance, 162)) {
+                av_log(s1, AV_LOG_ERROR,
+                       "RFC 2435 requires standard Huffman tables for jpeg\n");
+                return;
+            }
         } else if (buf[i + 1] == SOS) {
             /* SOS is last marker in the header */
             i += AV_RB16(&buf[i + 2]) + 2;
@@ -92,6 +119,10 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
             break;
         }
     }
+    if (nb_qtables && nb_qtables != 2)
+        av_log(s1, AV_LOG_WARNING,
+               "RFC 2435 suggests two quantization tables, %d provided\n",
+               nb_qtables);
 
     /* skip JPEG header */
     buf  += i;
@@ -130,7 +161,7 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
             bytestream_put_be16(&p, 64 * nb_qtables);
 
             for (i = 0; i < nb_qtables; i++)
-                bytestream_put_buffer(&p, &qtables[65 * i + 1], 64);
+                bytestream_put_buffer(&p, qtables[i], 64);
         }
 
         /* copy payload data */