Skip to content

Commit 527c0f5

Browse files
ireaderireader
committed
fix: rtmp url parameter overflow
1 parent c7dc69c commit 527c0f5

File tree

2 files changed

+167
-2
lines changed

2 files changed

+167
-2
lines changed

‎libmpeg/test/mov-2-mpeg-ps-test.cpp

+165
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
#include "mov-reader.h"
2+
#include "mov-format.h"
3+
#include "../../libmov/test/mov-file-buffer.h"
4+
#include "mpeg4-hevc.h"
5+
#include "mpeg4-avc.h"
6+
#include "mpeg4-aac.h"
7+
#include "mpeg-ps.h"
8+
#include "sys/system.h"
9+
#include <stdio.h>
10+
#include <stdlib.h>
11+
#include <string.h>
12+
#include <assert.h>
13+
#include <map>
14+
15+
static uint8_t s_buffer[2 * 1024 * 1024];
16+
static uint8_t s_packet[2 * 1024 * 1024];
17+
static std::map<int, int> s_objects;
18+
static std::map<int, int> s_tracks;
19+
static struct mpeg4_hevc_t s_hevc;
20+
static struct mpeg4_avc_t s_avc;
21+
static struct mpeg4_aac_t s_aac;
22+
23+
static void* ps_alloc(void* /*param*/, size_t bytes)
24+
{
25+
static char s_buffer[2 * 1024 * 1024];
26+
assert(bytes <= sizeof(s_buffer));
27+
return s_buffer;
28+
}
29+
30+
static void ps_free(void* /*param*/, void* /*packet*/)
31+
{
32+
return;
33+
}
34+
35+
static int ps_write(void* param, int stream, void* packet, size_t bytes)
36+
{
37+
return 1 == fwrite(packet, bytes, 1, (FILE*)param) ? 0 : ferror((FILE*)param);
38+
}
39+
40+
inline const char* ftimestamp(uint32_t t, char* buf)
41+
{
42+
sprintf(buf, "%02u:%02u:%02u.%03u", t / 3600000, (t / 60000) % 60, (t / 1000) % 60, t % 1000);
43+
return buf;
44+
}
45+
46+
static void mov_onread(void* ps, uint32_t track, const void* buffer, size_t bytes, int64_t pts, int64_t dts, int flags)
47+
{
48+
static char s_pts[64], s_dts[64];
49+
static int64_t v_pts, v_dts;
50+
static int64_t a_pts, a_dts;
51+
static int64_t x_pts, x_dts;
52+
53+
auto it = s_tracks.find(track);
54+
if (it == s_tracks.end())
55+
{
56+
assert(0);
57+
return;
58+
}
59+
60+
switch (s_objects.find(track)->second)
61+
{
62+
case MOV_OBJECT_H264:
63+
{
64+
printf("[H264] pts: %s, dts: %s, diff: %03d/%03d, bytes: %u%s\n", ftimestamp(pts, s_pts), ftimestamp(dts, s_dts), (int)(pts - v_pts), (int)(dts - v_dts), (unsigned int)bytes, flags ? " [I]" : "");
65+
v_pts = pts;
66+
v_dts = dts;
67+
68+
assert(h264_is_new_access_unit((const uint8_t*)buffer + 4, bytes - 4));
69+
int n = h264_mp4toannexb(&s_avc, buffer, bytes, s_packet, sizeof(s_packet));
70+
ps_muxer_input((ps_muxer_t*)ps, it->second, flags ? 0x01 : 0x00, pts * 90, dts * 90, s_packet, bytes);
71+
break;
72+
}
73+
case MOV_OBJECT_HEVC:
74+
{
75+
uint8_t nalu_type = (((const uint8_t*)buffer)[4] >> 1) & 0x3F;
76+
uint8_t irap = 16 <= nalu_type && nalu_type <= 23;
77+
78+
printf("[H265] pts: %s, dts: %s, diff: %03d/%03d, bytes: %u%s,%d\n", ftimestamp(pts, s_pts), ftimestamp(dts, s_dts), (int)(pts - v_pts), (int)(dts - v_dts), (unsigned int)bytes, flags ? " [I]" : "", (unsigned int)nalu_type);
79+
v_pts = pts;
80+
v_dts = dts;
81+
82+
assert(h265_is_new_access_unit((const uint8_t*)buffer + 4, bytes - 4));
83+
int n = h265_mp4toannexb(&s_hevc, buffer, bytes, s_packet, sizeof(s_packet));
84+
ps_muxer_input((ps_muxer_t*)ps, it->second, flags ? 0x01 : 0x00, pts * 90, dts * 90, s_packet, bytes);
85+
break;
86+
}
87+
case MOV_OBJECT_AAC:
88+
{
89+
printf("[AAC] pts: %s, dts: %s, diff: %03d/%03d, bytes: %u\n", ftimestamp(pts, s_pts), ftimestamp(dts, s_dts), (int)(pts - a_pts), (int)(dts - a_dts), (unsigned int)bytes);
90+
a_pts = pts;
91+
a_dts = dts;
92+
93+
int n = mpeg4_aac_adts_save(&s_aac, bytes, s_packet, sizeof(s_packet));
94+
memcpy(s_packet+n, buffer, bytes);
95+
ps_muxer_input((ps_muxer_t*)ps, it->second, flags ? 0x01 : 0x00, pts * 90, dts * 90, s_packet, bytes+n);
96+
break;
97+
}
98+
default:
99+
printf("[X] pts: %s, dts: %s, diff: %03d/%03d, bytes: %u\n", ftimestamp(pts, s_pts), ftimestamp(dts, s_dts), (int)(pts - x_pts), (int)(dts - x_dts), (unsigned int)bytes);
100+
x_pts = pts;
101+
x_dts = dts;
102+
break;
103+
}
104+
}
105+
106+
static void mov_video_info(void* param, uint32_t track, uint8_t object, int width, int height, const void* extra, size_t bytes)
107+
{
108+
s_objects[track] = object;
109+
if (MOV_OBJECT_H264 == object)
110+
{
111+
mpeg4_avc_decoder_configuration_record_load((const uint8_t*)extra, bytes, &s_avc);
112+
s_tracks[track] = ps_muxer_add_stream((ps_muxer_t*)param, PSI_STREAM_H264, NULL, 0);
113+
}
114+
else if (MOV_OBJECT_HEVC == object)
115+
{
116+
mpeg4_hevc_decoder_configuration_record_load((const uint8_t*)extra, bytes, &s_hevc);
117+
s_tracks[track] = ps_muxer_add_stream((ps_muxer_t*)param, PSI_STREAM_H265, NULL, 0);
118+
}
119+
}
120+
121+
static void mov_audio_info(void* param, uint32_t track, uint8_t object, int channel_count, int bit_per_sample, int sample_rate, const void* extra, size_t bytes)
122+
{
123+
s_objects[track] = object;
124+
if (MOV_OBJECT_AAC == object)
125+
{
126+
assert(bytes == mpeg4_aac_audio_specific_config_load((const uint8_t*)extra, bytes, &s_aac));
127+
assert(channel_count == s_aac.channels);
128+
assert(MOV_OBJECT_AAC == object);
129+
s_aac.profile = MPEG4_AAC_LC;
130+
s_aac.channel_configuration = channel_count;
131+
s_aac.sampling_frequency_index = mpeg4_aac_audio_frequency_from(sample_rate);
132+
s_tracks[track]= ps_muxer_add_stream((ps_muxer_t*)param, PSI_STREAM_AAC, NULL, 0);
133+
}
134+
}
135+
136+
void mov_2_mpeg_ps_test(const char* mp4)
137+
{
138+
char output[256] = { 0 };
139+
snprintf(output, sizeof(output) - 1, "%s.ps", mp4);
140+
141+
struct ps_muxer_func_t handler;
142+
handler.alloc = ps_alloc;
143+
handler.write = ps_write;
144+
handler.free = ps_free;
145+
146+
FILE* fp = fopen(output, "wb");
147+
ps_muxer_t* ps = ps_muxer_create(&handler, fp);
148+
149+
struct mov_file_cache_t file;
150+
memset(&file, 0, sizeof(file));
151+
file.fp = fopen(mp4, "rb");
152+
mov_reader_t* mov = mov_reader_create(mov_file_cache_buffer(), &file);
153+
154+
struct mov_reader_trackinfo_t info = { mov_video_info, mov_audio_info };
155+
mov_reader_getinfo(mov, &info, ps);
156+
157+
while (mov_reader_read(mov, s_buffer, sizeof(s_buffer), mov_onread, ps) > 0)
158+
{
159+
}
160+
161+
mov_reader_destroy(mov);
162+
ps_muxer_destroy(ps);
163+
fclose(file.fp);
164+
fclose(fp);
165+
}

‎librtmp/include/rtmp-url.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ static int rtmp_url_parse(const char* url, struct rtmp_url_t* u)
3535

3636
n = 0;
3737
memset(u, 0, sizeof(*u));
38-
u->port = (u_short)(0 == uri->port ? PORT : uri->port);
38+
u->port = (unsigned short)(0 == uri->port ? PORT : uri->port);
3939

4040
u->host = u->__ptr + n;
4141
r = snprintf(u->host, sizeof(u->__ptr) - n, "%s", uri->host);
@@ -54,7 +54,7 @@ static int rtmp_url_parse(const char* url, struct rtmp_url_t* u)
5454
if (uri->query && *uri->query)
5555
{
5656
q = NULL;
57-
for(r = uri_query(uri->query, uri->query + strlen(uri->query), &q); r > 0; r--)
57+
for(r = uri_query(uri->query, uri->query + strlen(uri->query), &q) - 1; r >= 0; r--)
5858
{
5959
if (5 == q[r].n_name && 0 == strncmp("vhost", q[r].name, 5))
6060
{

0 commit comments

Comments
 (0)