Changeset 29007

Timestamp:

01/25/09 16:37:56 (4 years ago)

Author:

itkz

Message:

fixed bounding error in RTMP body chunk

Location:

lang/c/librtmp

Files:

• main.c (modified) (3 diffs)
• rtmp_packet.c (modified) (11 diffs)

lang/c/librtmp/main.c

@@ -71 +71 @@
         0x2C, 0x30, 0x2C, 0x31, 0x2C, 0x31, 0x32, 0x33,
         0x00, 0x0C, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69,
-        0x6C, 0x69, 0x74, 0x69, 0x65, 0x73, 0x00, 0x40,//
+        0x6C, 0x69, 0x74, 0x69, 0x65, 0x73, 0x00, 0x40,
         0x3F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x09, 0x03, 0x00, 0x05, 0x6C, 0x65, 0x76,
@@ -80 +80 @@
         0x6E, 0x2E, 0x43, 0x6F, 0x6E, 0x6E, 0x65, 0x63,
         0x74, 0x2E, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73,
-        0x73, 0x00, 0x0B, 0x64, 0x65, 0x73, 0x63, 0x72,//
+        0x73, 0x00, 0x0B, 0x64, 0x65, 0x73, 0x63, 0x72,
         0x69, 0x70, 0x74, 0x69, 0x6F, 0x6E, 0x02, 0x00,
         0x15, 0x43, 0x6F, 0x6E, 0x6E, 0x65, 0x63, 0x74,
@@ -102 +102 @@
         rtmp_packet,
         rtmp_packet_temp, sizeof(rtmp_packet_temp),
-        4096,
+        AMF_CHANK_SIZE,
         &outputed_size);
     printf("analyzed size: %d\n", outputed_size);

lang/c/librtmp/rtmp_packet.c

@@ -32 +32 @@
 
 static void rtmp_packet_cleanup(rtmp_packet_t *packet);
-static unsigned char *rtmp_packet_retrieve_amf(
-    unsigned char *amf_chunks, size_t amf_with_chunk_header_size,
-    size_t amf_chunk_size,
-    size_t *return_amf_size);
+static unsigned char *rtmp_packet_retrieve_body(
+    unsigned char *amf_chunks, size_t rtmp_body_size,
+    size_t amf_chunk_size, int chunk_delimiter_num);
 static size_t rtmp_packet_insert_amf_chunk_header(
     rtmp_packet_t *packet,
@@ -44 +43 @@
 static rtmp_result_t rtmp_packet_amf_analyze(
     rtmp_packet_t *packet,
-    unsigned char *amf_packets_buffer, size_t amf_size);
+    unsigned char *amf_packets_buffer, size_t rtmp_body_size);
 
 
@@ -79 +78 @@
 
 
-unsigned char *rtmp_packet_retrieve_amf(
-    unsigned char *amf_chunks, size_t amf_with_chunk_header_size,
-    size_t amf_chunk_size,
-    size_t *return_amf_size)
-{
-    int chunk_delimiter_num;
+unsigned char *rtmp_packet_retrieve_body(
+    unsigned char *amf_chunks, size_t rtmp_body_size,
+    size_t amf_chunk_size, int chunk_delimiter_num)
+{
     int amf_size_count;
     size_t amf_moved_size;
-    size_t amf_size;
     unsigned char *amf_output_buffer;
-
-    chunk_delimiter_num = 0;
-    amf_size_count = amf_with_chunk_header_size - amf_chunk_size;
-    while (amf_size_count > 0) {
-        chunk_delimiter_num++;
-        amf_size_count -= amf_chunk_size + 1; /* 1 is delimiter(0xC3) */
-    }
-    amf_size = amf_with_chunk_header_size - chunk_delimiter_num;
-    amf_output_buffer = (unsigned char*)malloc(amf_size);
+    size_t rtmp_body_with_chunk_delimiter_size;
+
+    amf_output_buffer = (unsigned char*)malloc(rtmp_body_size);
     if (amf_output_buffer == NULL) {
-        *return_amf_size = 0;
         return NULL;
     }
     amf_size_count = 0;
     amf_moved_size = 0;
-    while (amf_size_count < amf_with_chunk_header_size) {
-        int rest = amf_with_chunk_header_size - amf_size_count;
+    rtmp_body_with_chunk_delimiter_size =
+        rtmp_body_size + chunk_delimiter_num;
+    while (amf_size_count < rtmp_body_with_chunk_delimiter_size) {
+        int rest = rtmp_body_with_chunk_delimiter_size - amf_size_count;
         if (rest < amf_chunk_size) {
             memmove(
@@ -120 +111 @@
         amf_size_count += amf_chunk_size + 1; /* 1 is delimiter(0xC3) */
     }
-    *return_amf_size = amf_size;
     return amf_output_buffer;
 }
@@ -133 +123 @@
     int header_size_magic;
     int header_size;
-    size_t amf_with_chunk_header_size;
+    size_t rtmp_body_size;
     unsigned char *amf_chunks;
     unsigned char *amf_buffer;
-    size_t amf_size;
     rtmp_result_t amf_ret;
+    int chunk_delimiter_num;
+    int amf_size_count;
 
     if (data_size == 0) {
@@ -172 +163 @@
     packet->timer = read_be24int(data + 1);
 #ifdef DEBUG
-    printf("timer: %d\n", packet->timer);
+    printf("timer: %ld\n", packet->timer);
 #endif
     if (header_size_magic == HEADER_MAGIC_04) {
@@ -183 +174 @@
         return RTMP_ERROR_DIVIDED_PACKET;
     }
-    amf_with_chunk_header_size = read_be24int(data + 4);
-#ifdef DEBUG
-    printf("amf_with_chunk_header_size: %d\n", amf_with_chunk_header_size);
+    rtmp_body_size = read_be24int(data + 4);
+#ifdef DEBUG
+    printf("rtmp_body_size: %d\n", rtmp_body_size);
+#endif
+    chunk_delimiter_num = 0;
+    amf_size_count = amf_chunk_size;
+    while (amf_size_count < rtmp_body_size) {
+        chunk_delimiter_num++;
+        amf_size_count -= amf_chunk_size;
+    }
+#ifdef DEBUG
+    printf("chunk_delimiter_num: %d\n", chunk_delimiter_num);
 #endif
     packet->data_type = data[7];
@@ -193 +193 @@
     if (header_size_magic == HEADER_MAGIC_08) {
         header_size = 8;
-        if (amf_with_chunk_header_size == 0) {
+        if (rtmp_body_size == 0) {
             *packet_size = 8;
             return RTMP_SUCCESS;
@@ -205 +205 @@
         header_size = 12;
         packet->stream_id = read_le32int(data + 8);
-        if (amf_with_chunk_header_size == 0) {
+        if (rtmp_body_size == 0) {
             *packet_size = 12;
             return RTMP_SUCCESS;
@@ -211 +211 @@
         amf_chunks = data + 12;
     }
-    if (header_size + amf_with_chunk_header_size > data_size) {
+    if (header_size + rtmp_body_size > data_size) {
         *packet_size = 0;
         return RTMP_ERROR_BROKEN_PACKET;
     }
-    *packet_size = header_size + amf_with_chunk_header_size;
-
-    amf_buffer = rtmp_packet_retrieve_amf(
-        amf_chunks, amf_with_chunk_header_size, amf_chunk_size, &amf_size);
-    amf_ret = rtmp_packet_amf_analyze(packet, amf_buffer, amf_size);
+    *packet_size = header_size + rtmp_body_size;
+
+    amf_buffer = rtmp_packet_retrieve_body(
+        amf_chunks, rtmp_body_size, amf_chunk_size, chunk_delimiter_num);
+    amf_ret = rtmp_packet_amf_analyze(packet, amf_buffer, rtmp_body_size);
     free(amf_buffer);
 
@@ -326 +326 @@
             amf_size - total_serialized_amf_size);
         if (serialized_amf_size == 0) {
+#ifdef DEBUG
             printf("AMF serialized error!\n");
+#endif
         }
         total_serialized_amf_size += serialized_amf_size;