[issue2270] RTP parser fails on RFC 3550 header extensions

[Robert Schlabbach]

Robert Schlabbach <rober...@gmx.net> added the comment:

Here is the SVN diff patch, tested with patcheck, 
which only complained about a missing changelog entry. 
But since the source file had no changelog entries at 
all, I suppose that's ok?

________________________________________________
FFmpeg issue tracker <iss...@roundup.ffmpeg.org>
<https://roundup.ffmpeg.org/issue2270>
________________________________________________
Index: ffmpeg/libavformat/rtpdec.c
===================================================================
--- ffmpeg/libavformat/rtpdec.c (.../svn://svn.ffmpeg.org/ffmpeg/trunk) 
(revision 25334)
+++ ffmpeg/libavformat/rtpdec.c (.../ffmpeg)    (working copy)
@@ -416,6 +416,7 @@
 {
     unsigned int ssrc, h;
     int payload_type, seq, ret, flags = 0;
+    int ext;
     AVStream *st;
     uint32_t timestamp;
     int rv= 0;
@@ -443,9 +444,36 @@
     }
 
     s->seq = seq;
+
+    /* RFC 3550 Section 5.3.1 RTP Header Extension handling */
+
+    // store RTP header extension bit
+    ext = buf[0] & 0x10;
+
+    // skip past RTP header
     len -= 12;
     buf += 12;
 
+    // check for RTP header extension
+    if (ext) {
+        // retrieve header extension length (number of 32-bit words)
+        ext = AV_RB16(buf + 2);
+
+        // add header extension itself to extension length
+        ext++;
+
+        // convert header extension length to bytes
+        ext <<= 2;
+
+        // abort if extension length exceeds remaining buffer length
+        if (len < ext)
+            return -1;
+
+        // skip past RTP header extension
+        len -= ext;
+        buf += ext;
+    };
+
     if (!st) {
         /* specific MPEG2TS demux support */
         ret = ff_mpegts_parse_packet(s->ts, pkt, buf, len);