New submission from Robert Schlabbach <rober...@gmx.net>:
The RTP parser in rtpdec.c contains a bug in
rtp_parse_packet_internal(): If ff_mpegts_parse_packet
() returns that only a part of the buffer was
processed, the remaining buffer is stored, but s-
>prev_ret is _not_ set to 1.
As a result, when rtp_parse_packet() is called again
to process the remaining data, the call does not reach
the location where the remaining buffer is handled,
but rather ends in a call to rtp_parse_queued_packet
(), because s->prev_ret is not set.
I'm not sure if it'd also be necessary to set s-
>prev_ret to 0 in case ff_mpegts_parse_packet()
returns -1 (line 474). The case ret >= len will never
happen, so the return 0; (line 482) statement is never
reached.
I've tested this patch and it appears to make RTP/UDP
multicast streaming through SDP input files work,
which was completely broken without this patch.
----------
files: rtpdec_mpegts_handling_bugfix.patch.c
messages: 12184
priority: normal
status: new
substatus: new
title: rtpdec.c drops partially processed mpeg-ts contents (one-line bugfix
provided)
type: patch
________________________________________________
FFmpeg issue tracker <iss...@roundup.ffmpeg.org>
<https://roundup.ffmpeg.org/issue2280>
________________________________________________
Index: ffmpeg/libavformat/rtpdec.c
===================================================================
--- ffmpeg/libavformat/rtpdec.c (.../svn://svn.ffmpeg.org/ffmpeg/trunk)
(revision 25401)
+++ ffmpeg/libavformat/rtpdec.c (.../ffmpeg) (working copy)
@@ -477,6 +477,7 @@
s->read_buf_size = len - ret;
memcpy(s->buf, buf + ret, s->read_buf_size);
s->read_buf_index = 0;
+ s->prev_ret = 1;
return 1;
}
return 0;
