---
libavformat/rtmpproto.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index a2efe38..ce85892 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -515,6 +515,12 @@ static int gen_pong(URLContext *s, RTMPContext *rt,
RTMPPacket *ppkt)
uint8_t *p;
int ret;
+ if (ppkt->data_size < 6) {
+ av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n",
+ ppkt->data_size);
+ return AVERROR_INVALIDDATA;
+ }
+
if ((ret = ff_rtmp_packet_create(&pkt, RTMP_NETWORK_CHANNEL, RTMP_PT_PING,
ppkt->timestamp + 1, 6)) < 0)
return ret;
@@ -913,6 +919,12 @@ static int handle_ping(URLContext *s, RTMPPacket *pkt)
RTMPContext *rt = s->priv_data;
int t, ret;
+ if (pkt->data_size < 2) {
+ av_log(s, AV_LOG_ERROR, "Too short ping packet (%d)\n",
+ pkt->data_size);
+ return AVERROR_INVALIDDATA;
+ }
+
t = AV_RB16(pkt->data);
if (t == 6) {
if ((ret = gen_pong(s, rt, pkt)) < 0)
--
1.7.11.1
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
