diff options
| -rw-r--r-- | gst/rtp/gstrtpgstdepay.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/gst/rtp/gstrtpgstdepay.c b/gst/rtp/gstrtpgstdepay.c index c992abf0b..7978a39f5 100644 --- a/gst/rtp/gstrtpgstdepay.c +++ b/gst/rtp/gstrtpgstdepay.c @@ -197,7 +197,7 @@ gst_rtp_gst_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) GstBuffer *subbuf, *outbuf = NULL; gint payload_len; guint8 *payload; - guint CV; + guint CV, frag_offset, avail; rtpgstdepay = GST_RTP_GST_DEPAY (depayload); @@ -223,9 +223,12 @@ gst_rtp_gst_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) * | Frag_offset | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ - /* frag_offset = - * (payload[4] << 24) | (payload[5] << 16) | (payload[6] << 8) | payload[7]; - */ + frag_offset = + (payload[4] << 24) | (payload[5] << 16) | (payload[6] << 8) | payload[7]; + + avail = gst_adapter_available (rtpgstdepay->adapter); + if (avail != frag_offset) + goto wrong_frag; /* subbuffer skipping the 8 header bytes */ subbuf = gst_rtp_buffer_get_payload_subbuffer (buf, 8, -1); @@ -326,6 +329,12 @@ empty_packet: ("Empty Payload."), (NULL)); return NULL; } +wrong_frag: + { + gst_adapter_clear (rtpgstdepay->adapter); + GST_LOG_OBJECT (rtpgstdepay, "wrong fragment, skipping"); + return NULL; + } too_small: { GST_ELEMENT_WARNING (rtpgstdepay, STREAM, DECODE, |