X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=modules%2Faccess%2Frtmp%2Frtmp_amf_flv.c;h=2299db113aa034dcec56879271cce05deaa63aa3;hb=a7d8f15b883c087c33af56f3a18d672c69cfb938;hp=e0dd56d69bca96377ada068d516d0822bb9bf900;hpb=aa5fe86aed9096e92e1f4b0affbb4f6c0c6080ff;p=vlc diff --git a/modules/access/rtmp/rtmp_amf_flv.c b/modules/access/rtmp/rtmp_amf_flv.c index e0dd56d69b..2299db113a 100644 --- a/modules/access/rtmp/rtmp_amf_flv.c +++ b/modules/access/rtmp/rtmp_amf_flv.c @@ -27,7 +27,7 @@ # include "config.h" #endif -#include +#include #include #include /* DOWN: #include */ @@ -223,6 +223,7 @@ const uint8_t FLV_VIDEO_FRAME_TYPE_MASK = 0xF0; const uint8_t FLV_VIDEO_FRAME_TYPE_KEYFRAME = 0x10; const uint8_t FLV_VIDEO_FRAME_TYPE_INTER_FRAME = 0x20; const uint8_t FLV_VIDEO_FRAME_TYPE_DISPOSABLE_INTER_FRAME = 0x30; + /***************************************************************************** * static RTMP functions: ******************************************************************************/ @@ -429,6 +430,12 @@ rtmp_connect_active( rtmp_control_thread_t *p_thread ) free( tmp_buffer ); tmp_url = (char *) malloc( strlen( "rtmp://") + strlen( p_thread->url.psz_buffer ) + 1 ); + if( !tmp_url ) + { + free( rtmp_body->body ); + free( rtmp_body ); + return -1; + } sprintf( tmp_url, "rtmp://%s", p_thread->url.psz_buffer ); tmp_buffer = amf_encode_object_variable( "tcUrl", AMF_DATATYPE_STRING, tmp_url ); @@ -781,6 +788,8 @@ rtmp_build_bytes_read( rtmp_control_thread_t *p_thread, uint32_t reply ) rtmp_body = rtmp_body_new( -1 ); tmp_buffer = (uint8_t *) malloc( sizeof( uint32_t ) * sizeof( uint8_t ) ); + if( !tmp_buffer ) return NULL; + reply = hton32( reply ); memcpy( tmp_buffer, &reply, sizeof( uint32_t ) ); @@ -997,6 +1006,7 @@ rtmp_read_net_packet( rtmp_control_thread_t *p_thread ) if( p_thread->rtmp_headers_recv[stream_index].length_body == p_thread->rtmp_headers_recv[stream_index].body->length_body ) { rtmp_packet = (rtmp_packet_t *) malloc( sizeof( rtmp_packet_t ) ); + if( !rtmp_packet ) goto error; rtmp_packet->stream_index = stream_index; rtmp_packet->timestamp = p_thread->rtmp_headers_recv[stream_index].timestamp; @@ -1014,7 +1024,6 @@ rtmp_read_net_packet( rtmp_control_thread_t *p_thread ) error: msg_Err( p_thread, "rtmp_read_net_packet: net_Read error"); - return NULL; } @@ -1042,6 +1051,7 @@ rtmp_init_handler( rtmp_handler_t *rtmp_handler ) static void rtmp_handler_null( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet ) { + VLC_UNUSED(p_thread); free( rtmp_packet->body->body ); free( rtmp_packet->body ); free( rtmp_packet ); @@ -1148,11 +1158,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send connection bandwith" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1167,11 +1174,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send server bandwith" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1186,11 +1190,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send clear stream" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1205,11 +1206,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send reply NetConnection.connect" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1229,11 +1227,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send reply createStream" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1248,11 +1243,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send reset stream" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1267,11 +1259,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send clear stream" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1308,11 +1297,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send reply NetStream.play.reset" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1327,11 +1313,8 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet i_ret = net_Write( p_thread, p_thread->fd, NULL, tmp_buffer, tmp_rtmp_packet->length_encoded ); if( i_ret != tmp_rtmp_packet->length_encoded ) { - free( tmp_rtmp_packet->body->body ); - free( tmp_rtmp_packet->body ); - free( tmp_rtmp_packet ); - free( tmp_buffer ); msg_Err( p_thread, "failed send reply NetStream.play.start" ); + goto error; } free( tmp_rtmp_packet->body->body ); free( tmp_rtmp_packet->body ); @@ -1463,6 +1446,14 @@ rtmp_handler_invoke( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet free( rtmp_packet->body->body ); free( rtmp_packet->body ); free( rtmp_packet ); + + return; + +error: + free( tmp_rtmp_packet->body->body ); + free( tmp_rtmp_packet->body ); + free( tmp_rtmp_packet ); + free( tmp_buffer ); } /* length header calculated automatically based on last packet in the same channel */ @@ -1474,6 +1465,8 @@ rtmp_new_packet( rtmp_control_thread_t *p_thread, uint8_t stream_index, uint32_t rtmp_packet_t *rtmp_packet; rtmp_packet = (rtmp_packet_t *) malloc( sizeof( rtmp_packet_t ) ); + if( !rtmp_packet ) return NULL; + interchunk_headers = body->length_body / p_thread->chunk_size_send; if( body->length_body % p_thread->chunk_size_send == 0 ) interchunk_headers--; @@ -1528,10 +1521,21 @@ rtmp_new_packet( rtmp_control_thread_t *p_thread, uint8_t stream_index, uint32_t rtmp_packet->src_dst = src_dst; rtmp_packet->body = (rtmp_body_t *) malloc( sizeof( rtmp_body_t ) ); + if( !rtmp_packet->body ) + { + free( rtmp_packet ); + return NULL; + } rtmp_packet->body->length_body = body->length_body; rtmp_packet->body->length_buffer = body->length_body; rtmp_packet->body->body = (uint8_t *) malloc( rtmp_packet->body->length_buffer * sizeof( uint8_t ) ); + if( !rtmp_packet->body->body ) + { + free( rtmp_packet->body ); + free( rtmp_packet ); + return NULL; + } memcpy( rtmp_packet->body->body, body->body, rtmp_packet->body->length_body ); return rtmp_packet; @@ -1576,6 +1580,8 @@ rtmp_encode_packet( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet int i, j; out = (uint8_t *) malloc( rtmp_packet->length_encoded * sizeof( uint8_t ) ); + if( !out ) return NULL; + interchunk_headers = rtmp_packet->body->length_body / p_thread->chunk_size_send; if( rtmp_packet->body->length_body % p_thread->chunk_size_send == 0 ) interchunk_headers--; @@ -1852,6 +1858,12 @@ rtmp_encode_NetStream_play_reset_onStatus( rtmp_control_thread_t *p_thread, char free( tmp_buffer ); description = (char *) malloc( strlen( "Playing and resetting ") + strlen( psz_media ) + strlen( "." ) + 1 ); + if( !description ) + { + free( rtmp_body->body ); + free( rtmp_body ); + return NULL; + } sprintf( description, "Playing and resetting %s.", psz_media ); tmp_buffer = amf_encode_object_variable( "description", AMF_DATATYPE_STRING, description ); @@ -1932,6 +1944,13 @@ rtmp_encode_NetStream_play_start_onStatus( rtmp_control_thread_t *p_thread, char free( tmp_buffer ); description = (char *) malloc( strlen( "Started playing ") + strlen( psz_media ) + strlen( "." ) + 1 ); + if( !description ) + { + free( rtmp_body->body ); + free( rtmp_body ); + return NULL; + } + sprintf( description, "Started playing %s.", psz_media ); tmp_buffer = amf_encode_object_variable( "description", AMF_DATATYPE_STRING, description ); @@ -2025,6 +2044,7 @@ rtmp_body_new( int length_buffer ) rtmp_body_t *rtmp_body; rtmp_body = (rtmp_body_t *) malloc( sizeof( rtmp_body_t ) ); + if( !rtmp_body ) return NULL; rtmp_body->length_body = 0; if( length_buffer < 0 ) @@ -2032,7 +2052,11 @@ rtmp_body_new( int length_buffer ) else rtmp_body->length_buffer = length_buffer; rtmp_body->body = (uint8_t *) malloc( rtmp_body->length_buffer * sizeof( uint8_t ) ); - + if( !rtmp_body->body ) + { + free( rtmp_body ); + return NULL; + } return rtmp_body; } @@ -2047,8 +2071,12 @@ rtmp_body_append( rtmp_body_t *rtmp_body, uint8_t *buffer, uint32_t length ) { if( rtmp_body->length_body + length > rtmp_body->length_buffer ) { + uint8_t *tmp; rtmp_body->length_buffer = rtmp_body->length_body + length; - rtmp_body->body = (uint8_t *) realloc( rtmp_body->body, rtmp_body->length_buffer * sizeof( uint8_t ) ); + tmp = realloc( rtmp_body->body, + rtmp_body->length_buffer * sizeof( uint8_t ) ); + if( !tmp ) return; + rtmp_body->body = tmp; } memcpy( rtmp_body->body + rtmp_body->length_body, buffer, length ); @@ -2061,7 +2089,8 @@ rtmp_body_append( rtmp_body_t *rtmp_body, uint8_t *buffer, uint32_t length ) static uint8_t * rtmp_encode_ping( uint16_t type, uint32_t src_dst, uint32_t third_arg, uint32_t fourth_arg ) { - uint8_t *out; + uint8_t *out = NULL; + VLC_UNUSED(fourth_arg); if( type == RTMP_PING_CLEAR_STREAM ) out = (uint8_t *) malloc( RTMP_PING_SIZE_CLEAR_STREAM * sizeof( uint8_t ) ); @@ -2070,7 +2099,7 @@ rtmp_encode_ping( uint16_t type, uint32_t src_dst, uint32_t third_arg, uint32_t else if( type == RTMP_PING_BUFFER_TIME_CLIENT ) { out = (uint8_t *) malloc( RTMP_PING_SIZE_BUFFER_TIME_CLIENT * sizeof( uint8_t ) ); - + if( !out ) goto error; third_arg = hton32( third_arg ); memcpy( out + 6, &third_arg, sizeof( uint32_t ) ); } @@ -2087,10 +2116,12 @@ rtmp_encode_ping( uint16_t type, uint32_t src_dst, uint32_t third_arg, uint32_t */ else { out = (uint8_t *) malloc( RTMP_PING_SIZE_BUFFER_TIME_CLIENT * sizeof( uint8_t ) ); - + if( !out ) goto error; out[6] = 0x0D; out[7] = 0x0E; out[8] = 0x0A; out[9] = 0x0D; } + if( !out ) goto error; + type = hton16( type ); memcpy( out, &type, sizeof( uint16_t ) ); @@ -2098,6 +2129,9 @@ rtmp_encode_ping( uint16_t type, uint32_t src_dst, uint32_t third_arg, uint32_t memcpy( out + 2, &src_dst, sizeof( uint32_t ) ); return out; + +error: + return NULL; } /***************************************************************************** @@ -2113,6 +2147,7 @@ amf_encode_element( uint8_t element, const void *value ) uint64_t number = *(uint64_t *) value; out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); + if( !out ) return NULL; number = hton64( number ); out[0] = AMF_DATATYPE_NUMBER; @@ -2120,6 +2155,7 @@ amf_encode_element( uint8_t element, const void *value ) } else if ( element == AMF_DATATYPE_BOOLEAN ) { out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_BOOLEAN * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_BOOLEAN; out[1] = *(uint8_t *) value; @@ -2129,6 +2165,7 @@ amf_encode_element( uint8_t element, const void *value ) length_psz = length_psz_cpy = strlen( (char *) value ); out = (uint8_t *) malloc( ( AMF_DATATYPE_SIZE_STRING + length_psz ) * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_STRING; length_psz = hton16( length_psz ); @@ -2137,11 +2174,13 @@ amf_encode_element( uint8_t element, const void *value ) } else if ( element == AMF_DATATYPE_OBJECT ) { out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_OBJECT * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_OBJECT; } else if ( element == AMF_DATATYPE_NULL ) { out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NULL * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_NULL; } else if ( element == AMF_DATATYPE_MIXED_ARRAY ) @@ -2149,6 +2188,7 @@ amf_encode_element( uint8_t element, const void *value ) uint32_t highest_index = *(uint32_t *) value; out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_MIXED_ARRAY * sizeof( uint8_t ) ); + if( !out ) return NULL; highest_index = hton32( highest_index ); out[0] = AMF_DATATYPE_MIXED_ARRAY; @@ -2161,6 +2201,7 @@ amf_encode_element( uint8_t element, const void *value ) } else { out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_NUMBER; out[1] = 0x0D; out[2] = 0x0E; out[3] = 0x0A; out[4] = 0x0D; @@ -2190,6 +2231,7 @@ amf_encode_object_variable( const char *key, uint8_t element, const void *value else { out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); + if( !out ) return NULL; out[0] = AMF_DATATYPE_NUMBER; out[1] = 0xD; out[2] = 0xE; out[3] = 0xA; out[4] = 0xD; @@ -2199,6 +2241,7 @@ amf_encode_object_variable( const char *key, uint8_t element, const void *value } out = (uint8_t *) malloc( ( AMF_DATATYPE_SIZE_OBJECT_VARIABLE + length_psz + length_value ) * sizeof( uint8_t ) ); + if( !out ) return NULL; length_psz = hton16( length_psz ); memcpy( out, &length_psz, sizeof( uint16_t ) ); @@ -2247,6 +2290,7 @@ amf_decode_string( uint8_t **buffer ) *buffer += sizeof( uint16_t ); out = (char *) malloc( length + 1 ); /* '\0' terminated */ + if( !out ) return NULL; for(i = 0; i < length; i++) out[i] = (*buffer)[i]; @@ -2280,11 +2324,15 @@ static void flv_rebuild( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet ) { uint32_t length_tag, timestamp; + uint8_t *tmp; - rtmp_packet->body->body = (uint8_t *) realloc( rtmp_packet->body->body, - rtmp_packet->body->length_body + FLV_TAG_PREVIOUS_TAG_SIZE + FLV_TAG_SIZE ); + tmp = (uint8_t *) realloc( rtmp_packet->body->body, + rtmp_packet->body->length_body + + FLV_TAG_PREVIOUS_TAG_SIZE + FLV_TAG_SIZE ); + if( !tmp ) return; + rtmp_packet->body->body = tmp; memmove( rtmp_packet->body->body + FLV_TAG_PREVIOUS_TAG_SIZE + FLV_TAG_SIZE, - rtmp_packet->body->body, rtmp_packet->body->length_body ); + rtmp_packet->body->body, rtmp_packet->body->length_body ); /* Insert tag */ p_thread->flv_tag_previous_tag_size = hton32( p_thread->flv_tag_previous_tag_size );