[FFmpeg-cvslog] rtpdec: Read the packet length for all RTCP packet types

[John Brooks]

ffmpeg | branch: release/0.7 | John Brooks <john.brooks at bluecherry.net> | Wed Oct 12 00:53:12 2011 -0600| [2c0cddf25517b2fbe208637e599d517832ebc0e3] | committer: Michael Niedermayer

rtpdec: Read the packet length for all RTCP packet types

This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.

Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit 07b77fe3871f86b87e35876d38f1969da5ece4b2)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c0cddf25517b2fbe208637e599d517832ebc0e3
---

 libavformat/rtpdec.c |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index bc0aea6..130a78d 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -111,14 +111,15 @@ RTPDynamicProtocolHandler *ff_rtp_handler_find_by_id(int id,
 static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len)
 {
     int payload_len;
-    while (len >= 2) {
+    while (len >= 4) {
+        payload_len = FFMIN(len, (AV_RB16(buf + 2) + 1) * 4);
+
         switch (buf[1]) {
         case RTCP_SR:
-            if (len < 20) {
+            if (payload_len < 20) {
                 av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n");
                 return AVERROR_INVALIDDATA;
             }
-            payload_len = (AV_RB16(buf + 2) + 1) * 4;
 
             s->last_rtcp_ntp_time = AV_RB64(buf + 8);
             s->last_rtcp_timestamp = AV_RB32(buf + 16);
@@ -129,14 +130,13 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int l
                 s->rtcp_ts_offset = s->last_rtcp_timestamp - s->base_timestamp;
             }
 
-            buf += payload_len;
-            len -= payload_len;
             break;
         case RTCP_BYE:
             return -RTCP_BYE;
-        default:
-            return -1;
         }
+
+        buf += payload_len;
+        len -= payload_len;
     }
     return -1;
 }