X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=modules%2Faccess%2Frtsp%2Freal_sdpplin.c;h=65b3d09e98d4b07c3393eff204b24e14bb004f22;hb=c60652e38ac6afd74bd8225e9dae5406f13aaa4f;hp=0a7d27dfa9b9c06ccb98a9ab07e0ceb06bafa6b4;hpb=4974f83a76238faa404e105fd077a1e1af4ce6fd;p=vlc

diff --git a/modules/access/rtsp/real_sdpplin.c b/modules/access/rtsp/real_sdpplin.c
index 0a7d27dfa9..65b3d09e98 100644
--- a/modules/access/rtsp/real_sdpplin.c
+++ b/modules/access/rtsp/real_sdpplin.c
@@ -17,354 +17,314 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: sdpplin.c,v 1.5 2004/04/23 21:59:04 miguelfreitas Exp $
+ * $Id$
  *
  * sdp/sdpplin parser.
  *
  */
- 
-#include "real.h"
 
-/*
- * Decodes base64 strings (based upon b64 package)
- */
+#include "real.h"
+#include <vlc_strings.h>
+#define BUFLEN 32000
 
-static char *b64_decode(const char *in, char *out, int *size)
-{
-    char dtable[256];              /* Encode / decode table */
-    int i,k;
-    unsigned int j;
+static inline char *nl(char *data) {
+  char *nlptr = (data) ? strchr(data,'\n') : NULL;
+  return (nlptr) ? nlptr + 1 : NULL;
+}
 
-    for (i = 0; i < 255; i++) {
-        dtable[i] = 0x80;
-    }
-    for (i = 'A'; i <= 'Z'; i++) {
-        dtable[i] = 0 + (i - 'A');
-    }
-    for (i = 'a'; i <= 'z'; i++) {
-        dtable[i] = 26 + (i - 'a');
-    }
-    for (i = '0'; i <= '9'; i++) {
-        dtable[i] = 52 + (i - '0');
-    }
-    dtable['+'] = 62;
-    dtable['/'] = 63;
-    dtable['='] = 0;
+static int filter(const char *in, const char *filter, char **out, size_t outlen) {
 
-    k=0;
-    /*CONSTANTCONDITION*/
-    for (j=0; j<strlen(in); j+=4)
-    {
-        char a[4], b[4];
+  int flen=strlen(filter);
+  size_t len;
 
-        for (i = 0; i < 4; i++)
-        {
-            int c = in[i+j];
+  if (!in) return 0;
 
-            if (dtable[c] & 0x80)
-            {
-                printf("Illegal character '%c' in input.\n", c);
-                exit(1);
-            }
-            a[i] = (char) c;
-            b[i] = (char) dtable[c];
-        }
-        //xine_buffer_ensure_size(out, k+3);
-        out[k++] = (b[0] << 2) | (b[1] >> 4);
-        out[k++] = (b[1] << 4) | (b[2] >> 2);
-        out[k++] = (b[2] << 6) | b[3];
-        i = a[2] == '=' ? 1 : (a[3] == '=' ? 2 : 3);
-        if (i < 3)
-        {
-            out[k]=0;
-            *size=k;
-            return out;
-        }
+  len = (strchr(in,'\n')) ? (size_t)(strchr(in,'\n')-in) : strlen(in);
+  if (!strncmp(in,filter,flen)) {
+    if(in[flen]=='"') flen++;
+    if(in[len-1]==13) len--;
+    if(in[len-1]=='"') len--;
+    if( len-flen+1 > outlen )
+    {
+        printf("Discarding end of string to avoid overflow");
+        len=outlen+flen-1;
     }
-    out[k]=0;
-    *size=k;
-    return out;
+    memcpy(*out, in+flen, len-flen+1);
+    (*out)[len-flen]=0;
+    return len-flen;
+  }
+  return 0;
 }
 
-static char *nl(char *data)
-{
-    char *nlptr = (data) ? strchr(data,'\n') : NULL;
-    return (nlptr) ? nlptr + 1 : NULL;
-}
+static sdpplin_stream_t *sdpplin_parse_stream(char **data) {
 
-static int filter(const char *in, const char *filter, char **out)
-{
-    int flen=strlen(filter);
-    int len;
+  sdpplin_stream_t *desc;
+  char* buf = NULL;
+  char* decoded = NULL;
+  int handled;
 
-    if (!in)
-        return 0;
+  desc = calloc( 1, sizeof(sdpplin_stream_t) );
+  if( !desc )
+    return NULL;
 
-    len = (strchr(in,'\n')) ? strchr(in,'\n')-in : strlen(in);
-    if (!strncmp(in,filter,flen))
-    {
-        if(in[flen]=='"') flen++;
-        if(in[len-1]==13) len--;
-        if(in[len-1]=='"') len--;
-        memcpy(*out, in+flen, len-flen+1);
-        (*out)[len-flen]=0;
-        return len-flen;
-    }
-    return 0;
-}
+  buf = malloc( BUFLEN );
+  if( !buf )
+    goto error;
 
-static sdpplin_stream_t *sdpplin_parse_stream(char **data)
-{
-    sdpplin_stream_t *desc = malloc(sizeof(sdpplin_stream_t));
-    char      *buf = malloc(32000);
-    char      *decoded = malloc(32000);
-    int       handled;
+  decoded = malloc( BUFLEN );
+  if( !decoded )
+    goto error;
 
-    if( !desc ) return NULL;
-    memset(desc, 0, sizeof(sdpplin_stream_t));
+  if (filter(*data, "m=", &buf, BUFLEN)) {
+    desc->id = strdup(buf);
+  } else {
+    lprintf("sdpplin: no m= found.\n");
+    goto error;
+  }
+  *data=nl(*data);
 
-    if( !buf ) goto error;
-    if( !decoded ) goto error;
+  while (*data && **data && *data[0]!='m') {
+    handled=0;
 
-    if (filter(*data, "m=", &buf))
-    {
-        desc->id = strdup(buf);
+    if(filter(*data,"a=control:streamid=",&buf, BUFLEN)) {
+        /* This way negative values are mapped to unfeasibly high
+         * values, and will be discarded afterward
+         */
+        unsigned long tmp = strtoul(buf, NULL, 10);
+        if ( tmp > UINT16_MAX )
+            lprintf("stream id out of bound: %lu\n", tmp);
+        else
+            desc->stream_id=tmp;
+        handled=1;
+        *data=nl(*data);
     }
-    else
-    {
-        lprintf("sdpplin: no m= found.\n");
-        goto error;
+    if(filter(*data,"a=MaxBitRate:integer;",&buf, BUFLEN)) {
+      desc->max_bit_rate=atoi(buf);
+      if (!desc->avg_bit_rate)
+        desc->avg_bit_rate=desc->max_bit_rate;
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=MaxPacketSize:integer;",&buf, BUFLEN)) {
+      desc->max_packet_size=atoi(buf);
+      if (!desc->avg_packet_size)
+        desc->avg_packet_size=desc->max_packet_size;
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=StartTime:integer;",&buf, BUFLEN)) {
+      desc->start_time=atoi(buf);
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=Preroll:integer;",&buf, BUFLEN)) {
+      desc->preroll=atoi(buf);
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=length:npt=",&buf, BUFLEN)) {
+      desc->duration=(uint32_t)(atof(buf)*1000);
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=StreamName:string;",&buf, BUFLEN)) {
+      desc->stream_name=strdup(buf);
+      desc->stream_name_size=strlen(desc->stream_name);
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=mimetype:string;",&buf, BUFLEN)) {
+      desc->mime_type=strdup(buf);
+      desc->mime_type_size=strlen(desc->mime_type);
+      handled=1;
+      *data=nl(*data);
+    }
+    if(filter(*data,"a=OpaqueData:buffer;",&buf, BUFLEN)) {
+      desc->mlti_data_size =
+          vlc_b64_decode_binary_to_buffer(decoded, BUFLEN, buf );
+      if ( desc->mlti_data_size ) {
+          desc->mlti_data = malloc(desc->mlti_data_size);
+          memcpy(desc->mlti_data, decoded, desc->mlti_data_size);
+          handled=1;
+          *data=nl(*data);
+          lprintf("mlti_data_size: %i\n", desc->mlti_data_size);
+      }
+    }
+    if(filter(*data,"a=ASMRuleBook:string;",&buf, BUFLEN)) {
+      desc->asm_rule_book=strdup(buf);
+      handled=1;
+      *data=nl(*data);
     }
-    *data=nl(*data);
-
-    while (*data && **data && *data[0]!='m')
-    {
-        handled=0;
-
-        if(filter(*data,"a=control:streamid=",&buf))
-        {
-            desc->stream_id=atoi(buf);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=MaxBitRate:integer;",&buf))
-        {
-            desc->max_bit_rate=atoi(buf);
-            if (!desc->avg_bit_rate)
-                desc->avg_bit_rate=desc->max_bit_rate;
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=MaxPacketSize:integer;",&buf))
-        {
-            desc->max_packet_size=atoi(buf);
-            if (!desc->avg_packet_size)
-                desc->avg_packet_size=desc->max_packet_size;
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=StartTime:integer;",&buf))
-        {
-            desc->start_time=atoi(buf);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=Preroll:integer;",&buf))
-        {
-            desc->preroll=atoi(buf);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=length:npt=",&buf))
-        {
-            desc->duration=(uint32_t)(atof(buf)*1000);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=StreamName:string;",&buf))
-        {
-            desc->stream_name=strdup(buf);
-            desc->stream_name_size=strlen(desc->stream_name);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=mimetype:string;",&buf))
-        {
-            desc->mime_type=strdup(buf);
-            desc->mime_type_size=strlen(desc->mime_type);
-            handled=1;
-            *data=nl(*data);
-        }
-        if(filter(*data,"a=OpaqueData:buffer;",&buf))
-        {
-            decoded = b64_decode(buf, decoded, &(desc->mlti_data_size));
-            desc->mlti_data = malloc(sizeof(char)*desc->mlti_data_size);
-            memcpy(desc->mlti_data, decoded, desc->mlti_data_size);
-            handled=1;
-            *data=nl(*data);
-            lprintf("mlti_data_size: %i\n", desc->mlti_data_size);
-        }
-        if(filter(*data,"a=ASMRuleBook:string;",&buf))
-        {
-            desc->asm_rule_book=strdup(buf);
-            handled=1;
-            *data=nl(*data);
-        }
 
-        if(!handled)
-        {
+    if(!handled) {
 #ifdef LOG
-            int len=strchr(*data,'\n')-(*data);
-            memcpy(buf, *data, len+1);
-            buf[len]=0;
-            printf("libreal: sdpplin: not handled: '%s'\n", buf);
+      int len=strchr(*data,'\n')-(*data);
+      memcpy(buf, *data, len+1);
+      buf[len]=0;
+      printf("libreal: sdpplin: not handled: '%s'\n", buf);
 #endif
-            *data=nl(*data);
-        }
+      *data=nl(*data);
     }
-    if( buf ) free(buf);
-    if( decoded )free(decoded);
-    return desc;
+  }
+  free( buf );
+  free( decoded) ;
+  return desc;
 
 error:
-    if( decoded ) free(decoded);
-    if( desc ) free( desc );
-    if( buf ) free( buf );
-    return NULL;
+  free( decoded );
+  free( desc );
+  free( buf );
+  return NULL;
 }
 
+
 sdpplin_t *sdpplin_parse(char *data)
 {
-    sdpplin_t        *desc = malloc(sizeof(sdpplin_t));
-    sdpplin_stream_t *stream;
-    char             *buf=malloc(3200);
-    char             *decoded=malloc(3200);
-    int              handled;
-    int              len;
+  sdpplin_t*        desc;
+  sdpplin_stream_t* stream;
+  char*             buf;
+  char*             decoded;
+  int               handled;
 
-    if( !desc ) return NULL;
-    if( !buf )
-    {
-        free( desc );
-        return NULL;
-    }
-    if( !decoded )
-    {
-        free( buf );
-        free( desc );
-        return NULL;
-    }
-    memset(desc, 0, sizeof(sdpplin_t));
+  desc = calloc( 1, sizeof(sdpplin_t) );
+  if( !desc )
+    return NULL;
 
-    while (data && *data)
-    {
-        handled=0;
+  buf = malloc( BUFLEN );
+  if( !buf )
+  {
+    free( desc );
+    return NULL;
+  }
 
-        if (filter(data, "m=", &buf))
-        {
-            stream=sdpplin_parse_stream(&data);
-            lprintf("got data for stream id %u\n", stream->stream_id);
-            desc->stream[stream->stream_id]=stream;
+  decoded = malloc( BUFLEN );
+  if( !decoded )
+  {
+    free( buf );
+    free( desc );
+    return NULL;
+  }
+  desc->stream = NULL;
+
+  while (data && *data) {
+    handled=0;
+
+    if (filter(data, "m=", &buf, BUFLEN)) {
+        if ( !desc->stream ) {
+            fprintf(stderr, "sdpplin.c: stream identifier found before stream count, skipping.");
             continue;
         }
-        if(filter(data,"a=Title:buffer;",&buf))
-        {
-            decoded=b64_decode(buf, decoded, &len);
-            desc->title=strdup(decoded);
-            handled=1;
-            data=nl(data);
-        }
-        if(filter(data,"a=Author:buffer;",&buf))
-        {
-            decoded=b64_decode(buf, decoded, &len);
-            desc->author=strdup(decoded);
-            handled=1;
-            data=nl(data);
-        }
-        if(filter(data,"a=Copyright:buffer;",&buf))
-        {
-            decoded=b64_decode(buf, decoded, &len);
-            desc->copyright=strdup(decoded);
-            handled=1;
-            data=nl(data);
-        }
-        if(filter(data,"a=Abstract:buffer;",&buf))
-        {
-            decoded=b64_decode(buf, decoded, &len);
-            desc->abstract=strdup(decoded);
-            handled=1;
-            data=nl(data);
-        }
-        if(filter(data,"a=StreamCount:integer;",&buf))
-        {
-            desc->stream_count=atoi(buf);
-            desc->stream = malloc(sizeof(sdpplin_stream_t*)*desc->stream_count);
-            handled=1;
-            data=nl(data);
-        }
-        if(filter(data,"a=Flags:integer;",&buf))
-        {
-            desc->flags=atoi(buf);
-            handled=1;
-            data=nl(data);
-        }
+        stream=sdpplin_parse_stream(&data);
+        lprintf("got data for stream id %u\n", stream->stream_id);
+        if ( stream->stream_id >= desc->stream_count )
+            lprintf("stream id %u is greater than stream count %u\n", stream->stream_id, desc->stream_count);
+        else
+            desc->stream[stream->stream_id]=stream;
+        continue;
+    }
+    if(filter(data,"a=Title:buffer;",&buf, BUFLEN)) {
+      desc->title=vlc_b64_decode(buf);
+      if(desc->title) {
+        handled=1;
+        data=nl(data);
+      }
+    }
+    if(filter(data,"a=Author:buffer;",&buf, BUFLEN)) {
+      desc->author=vlc_b64_decode(buf);
+      if(desc->author) {
+        handled=1;
+        data=nl(data);
+      }
+    }
+    if(filter(data,"a=Copyright:buffer;",&buf, BUFLEN)) {
+      desc->copyright=vlc_b64_decode(buf);
+      if(desc->copyright) {
+        handled=1;
+        data=nl(data);
+      }
+    }
+    if(filter(data,"a=Abstract:buffer;",&buf, BUFLEN)) {
+      desc->abstract=vlc_b64_decode(buf);
+      if(desc->abstract) {
+        handled=1;
+        data=nl(data);
+      }
+    }
+    if(filter(data,"a=StreamCount:integer;",&buf, BUFLEN)) {
+        /* This way negative values are mapped to unfeasibly high
+         * values, and will be discarded afterward
+         */
+        unsigned long tmp = strtoul(buf, NULL, 10);
+        if ( tmp > UINT16_MAX )
+            lprintf("stream count out of bound: %lu\n", tmp);
+        else
+            desc->stream_count = tmp;
+        desc->stream = malloc(sizeof(sdpplin_stream_t*)*desc->stream_count);
+        handled=1;
+        data=nl(data);
+    }
+    if(filter(data,"a=Flags:integer;",&buf, BUFLEN)) {
+      desc->flags=atoi(buf);
+      handled=1;
+      data=nl(data);
+    }
 
-        if(!handled)
-        {
+    if(!handled) {
 #ifdef LOG
-            int len=strchr(data,'\n')-data;
-            memcpy(buf, data, len+1);
-            buf[len]=0;
-            printf("libreal: sdpplin: not handled: '%s'\n", buf);
+      int len=strchr(data,'\n')-data;
+      memcpy(buf, data, len+1);
+      buf[len]=0;
+      printf("libreal: sdpplin: not handled: '%s'\n", buf);
 #endif
-            data=nl(data);
-        }
+      data=nl(data);
     }
+  }
 
-    free(decoded);
-    free(buf);
-    return desc;
+  free( decoded );
+  free( buf );
+  return desc;
 }
 
-void sdpplin_free(sdpplin_t *description)
-{
-    int i;
+void sdpplin_free(sdpplin_t *description) {
 
-    if( !description ) return;
+  int i;
 
-    for( i=0; i<description->stream_count; i++ )
-    {
-        if( description->stream[i] )
-        {
-            if( description->stream[i]->id ) free( description->stream[i]->id );
-            if( description->stream[i]->bandwidth ) free( description->stream[i]->bandwidth );
-            if( description->stream[i]->range ) free( description->stream[i]->range );
-            if( description->stream[i]->length ) free( description->stream[i]->length );
-            if( description->stream[i]->rtpmap ) free( description->stream[i]->rtpmap );
-            if( description->stream[i]->mimetype ) free( description->stream[i]->mimetype );
-            if( description->stream[i]->stream_name ) free( description->stream[i]->stream_name );
-            if( description->stream[i]->mime_type ) free( description->stream[i]->mime_type );
-            if( description->stream[i]->mlti_data ) free( description->stream[i]->mlti_data );
-            if( description->stream[i]->rmff_flags ) free( description->stream[i]->rmff_flags );
-            if( description->stream[i]->asm_rule_book ) free( description->stream[i]->asm_rule_book );
-        }
+  if( !description ) return;
+
+  for( i=0; i<description->stream_count; i++ ) {
+    if( description->stream[i] ) {
+      free( description->stream[i]->id );
+      free( description->stream[i]->bandwidth );
+      free( description->stream[i]->range );
+      free( description->stream[i]->length );
+      free( description->stream[i]->rtpmap );
+      free( description->stream[i]->mimetype );
+      free( description->stream[i]->stream_name );
+      free( description->stream[i]->mime_type );
+      free( description->stream[i]->mlti_data );
+      free( description->stream[i]->rmff_flags );
+      free( description->stream[i]->asm_rule_book );
+      free( description->stream[i] );
     }
+  }
+  if( description->stream_count )
     free( description->stream );
 
-    if( description->owner ) free( description->owner );
-    if( description->session_name ) free( description->session_name );
-    if( description->session_info ) free( description->session_info );
-    if( description->uri ) free( description->uri );
-    if( description->email ) free( description->email );
-    if( description->phone ) free( description->phone );
-    if( description->connection ) free( description->connection );
-    if( description->bandwidth ) free( description->bandwidth );
-    if( description->title ) free( description->title );
-    if( description->author ) free( description->author );
-    if( description->copyright ) free( description->copyright );
-    if( description->keywords ) free( description->keywords );
-    if( description->asm_rule_book ) free( description->asm_rule_book );
-    if( description->abstract ) free( description->abstract );
-    if( description->range ) free( description->range );
-    free(description);
+  free( description->owner );
+  free( description->session_name );
+  free( description->session_info );
+  free( description->uri );
+  free( description->email );
+  free( description->phone );
+  free( description->connection );
+  free( description->bandwidth );
+  free( description->title );
+  free( description->author );
+  free( description->copyright );
+  free( description->keywords );
+  free( description->asm_rule_book );
+  free( description->abstract );
+  free( description->range );
+  free( description );
 }
+