正在显示
1 个修改的文件
包含
9 行增加
和
5 行删除
trunk/research/librtmp/srs_ingest_flv.c
100644 → 100755
| @@ -229,7 +229,7 @@ int flv_read_packet(int flv_fd, int* type, u_int32_t* timestamp, char** data, in | @@ -229,7 +229,7 @@ int flv_read_packet(int flv_fd, int* type, u_int32_t* timestamp, char** data, in | ||
| 229 | char th[11]; // tag header | 229 | char th[11]; // tag header |
| 230 | char ts[4]; // tag size | 230 | char ts[4]; // tag size |
| 231 | 231 | ||
| 232 | - u_int32_t data_size = 0; | 232 | + int32_t data_size = 0; |
| 233 | u_int32_t time = 0; | 233 | u_int32_t time = 0; |
| 234 | 234 | ||
| 235 | char* pp; | 235 | char* pp; |
| @@ -263,17 +263,21 @@ int flv_read_packet(int flv_fd, int* type, u_int32_t* timestamp, char** data, in | @@ -263,17 +263,21 @@ int flv_read_packet(int flv_fd, int* type, u_int32_t* timestamp, char** data, in | ||
| 263 | 263 | ||
| 264 | *timestamp = time; | 264 | *timestamp = time; |
| 265 | 265 | ||
| 266 | - if (data_size > 0) { | 266 | + // check data size. |
| 267 | + if (data_size <= 0) { | ||
| 268 | + ret = -1; | ||
| 269 | + trace("invalid data size. size=%d, ret=%d", data_size, ret); | ||
| 270 | + return ret; | ||
| 271 | + } | ||
| 272 | + | ||
| 273 | + // read tag data. | ||
| 267 | *size = data_size; | 274 | *size = data_size; |
| 268 | *data = (char*)malloc(data_size); | 275 | *data = (char*)malloc(data_size); |
| 269 | - | ||
| 270 | - // read tag data | ||
| 271 | if (read(flv_fd, *data, data_size) != data_size) { | 276 | if (read(flv_fd, *data, data_size) != data_size) { |
| 272 | ret = -1; | 277 | ret = -1; |
| 273 | trace("read flv tag data failed. size=%d, ret=%d", data_size, ret); | 278 | trace("read flv tag data failed. size=%d, ret=%d", data_size, ret); |
| 274 | return ret; | 279 | return ret; |
| 275 | } | 280 | } |
| 276 | - } | ||
| 277 | 281 | ||
| 278 | // ignore 4bytes tag size. | 282 | // ignore 4bytes tag size. |
| 279 | if (read(flv_fd, ts, sizeof(ts)) != sizeof(ts)) { | 283 | if (read(flv_fd, ts, sizeof(ts)) != sizeof(ts)) { |
-
请 注册 或 登录 后发表评论