diff mbox series

[FFmpeg-devel] avformat/rtp: Pass sources and block filter addresses via sdp file for rtp

Message ID 20200302192109.16576-1-phunkyfish@gmail.com
State Superseded
Headers show
Series [FFmpeg-devel] avformat/rtp: Pass sources and block filter addresses via sdp file for rtp
Related show

Checks

Context Check Description
andriy/ffmpeg-patchwork pending
andriy/ffmpeg-patchwork success Applied patch
andriy/ffmpeg-patchwork success Configure finished
andriy/ffmpeg-patchwork success Make finished
andriy/ffmpeg-patchwork success Make fate finished

Commit Message

phunkyfish March 2, 2020, 7:21 p.m. UTC
---
 libavformat/rtsp.c | 49 ++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 41 insertions(+), 8 deletions(-)

Comments

Andreas Rheinhardt March 28, 2020, 12:02 a.m. UTC | #1
phunkyfish:
> ---
>  libavformat/rtsp.c | 49 ++++++++++++++++++++++++++++++++++++++--------
>  1 file changed, 41 insertions(+), 8 deletions(-)
> 
> diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
> index cd6fc32a29..d23ec5723e 100644
> --- a/libavformat/rtsp.c
> +++ b/libavformat/rtsp.c
> @@ -2447,8 +2447,8 @@ static int rtp_probe(const AVProbeData *p)
>  static int rtp_read_header(AVFormatContext *s)
>  {
>      uint8_t recvbuf[RTP_MAX_PACKET_LENGTH];
> -    char host[500], sdp[500];
> -    int ret, port;
> +    char host[500], sdp[1000], filters_buf[1000];
> +    int ret, port, sdp_length, nc;
>      URLContext* in = NULL;
>      int payload_type;
>      AVCodecParameters *par = NULL;
> @@ -2456,6 +2456,7 @@ static int rtp_read_header(AVFormatContext *s)
>      AVIOContext pb;
>      socklen_t addrlen = sizeof(addr);
>      RTSPState *rt = s->priv_data;
> +    const char *p;
>  
>      if (!ff_network_init())
>          return AVERROR(EIO);
> @@ -2513,12 +2514,41 @@ static int rtp_read_header(AVFormatContext *s)
>      av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port,
>                   NULL, 0, s->url);
>  
> -    snprintf(sdp, sizeof(sdp),
> -             "v=0\r\nc=IN IP%d %s\r\nm=%s %d RTP/AVP %d\r\n",
> -             addr.ss_family == AF_INET ? 4 : 6, host,
> -             par->codec_type == AVMEDIA_TYPE_DATA  ? "application" :
> -             par->codec_type == AVMEDIA_TYPE_VIDEO ? "video" : "audio",
> -             port, payload_type);
> +    sdp_length = snprintf(sdp + sdp_length, sizeof(sdp) - sdp_length,
> +                          "v=0\r\nc=IN IP%d %s\r\n",
> +                          addr.ss_family == AF_INET ? 4 : 6, host);
> +

sdp_length is used uninitialized here it is used uninitialized in the
version that was merged as b71685865fe761925feedda3cd0b288224d9a509. The
newer versions [2], [3] don't exhibit this flaw.

[3] and [1] also have a flaw in common that [2] and this one are
lacking: The semicolon of the definition of const char *p is missing.

Finally, neither of these versions here seems to have been based upon
git master which contains a call to av_log() directly after the above
snprintf.

- Andreas

[1]: https://ffmpeg.org/pipermail/ffmpeg-devel/2020-March/257887.html
[2]: https://ffmpeg.org/pipermail/ffmpeg-devel/2020-March/257989.html
[3]: https://ffmpeg.org/pipermail/ffmpeg-devel/2020-March/259128.html
diff mbox series

Patch

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index cd6fc32a29..d23ec5723e 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -2447,8 +2447,8 @@  static int rtp_probe(const AVProbeData *p)
 static int rtp_read_header(AVFormatContext *s)
 {
     uint8_t recvbuf[RTP_MAX_PACKET_LENGTH];
-    char host[500], sdp[500];
-    int ret, port;
+    char host[500], sdp[1000], filters_buf[1000];
+    int ret, port, sdp_length, nc;
     URLContext* in = NULL;
     int payload_type;
     AVCodecParameters *par = NULL;
@@ -2456,6 +2456,7 @@  static int rtp_read_header(AVFormatContext *s)
     AVIOContext pb;
     socklen_t addrlen = sizeof(addr);
     RTSPState *rt = s->priv_data;
+    const char *p;
 
     if (!ff_network_init())
         return AVERROR(EIO);
@@ -2513,12 +2514,41 @@  static int rtp_read_header(AVFormatContext *s)
     av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port,
                  NULL, 0, s->url);
 
-    snprintf(sdp, sizeof(sdp),
-             "v=0\r\nc=IN IP%d %s\r\nm=%s %d RTP/AVP %d\r\n",
-             addr.ss_family == AF_INET ? 4 : 6, host,
-             par->codec_type == AVMEDIA_TYPE_DATA  ? "application" :
-             par->codec_type == AVMEDIA_TYPE_VIDEO ? "video" : "audio",
-             port, payload_type);
+    sdp_length = snprintf(sdp + sdp_length, sizeof(sdp) - sdp_length,
+                          "v=0\r\nc=IN IP%d %s\r\n",
+                          addr.ss_family == AF_INET ? 4 : 6, host);
+
+    p = strchr(s->url, '?');
+    if (p) {
+        static const char *filters[][2] = {{"sources", "incl"}, {"block", "excl"}, {NULL, NULL}};
+        int i;
+        char *q;
+        for (i = 0; filters[i][0]; i++) {
+            if (av_find_info_tag(filters_buf, sizeof(filters_buf), filters[i][0], p)) {
+                /* av_log(s, AV_LOG_VERBOSE, "rtp_read_header() found %s %s\n", filters[i][0], filters_buf); */
+                q = filters_buf;
+                while ((q = strchr(q, ',')) != NULL)
+                    *q = ' ';
+                nc = snprintf(sdp + sdp_length, sizeof(sdp) - sdp_length,
+                          "a=source-filter:%s IN IP%d %s %s\r\n",
+                          filters[i][1],
+                          addr.ss_family == AF_INET ? 4 : 6, host,
+                          filters_buf);
+                if (nc < 0 || nc + sdp_length >= sizeof(sdp))
+                    goto fail_nobuf;
+                sdp_length += nc;
+            }
+        }
+    }
+
+    nc = snprintf(sdp + sdp_length, sizeof(sdp) - sdp_length,
+                  "m=%s %d RTP/AVP %d\r\n",
+                  par->codec_type == AVMEDIA_TYPE_DATA  ? "application" :
+                  par->codec_type == AVMEDIA_TYPE_VIDEO ? "video" : "audio",
+                  port, payload_type);
+    if (nc < 0 || nc + sdp_length >= sizeof(sdp))
+        goto fail_nobuf;
+    sdp_length += nc;
     av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", sdp);
     avcodec_parameters_free(&par);
 
@@ -2534,6 +2564,9 @@  static int rtp_read_header(AVFormatContext *s)
     s->pb = NULL;
     return ret;
 
+fail_nobuf:
+    ret = AVERROR(ENOBUFS);
+    av_log(s, AV_LOG_ERROR, "rtp_read_header(): not enough buffer space for sdp-headers\n");
 fail:
     avcodec_parameters_free(&par);
     if (in)