zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix potential use after free in H264 packetizer.

Browse Source 
BUG=webrtc:7116

Review-Url: https://codereview.webrtc.org/2677073002
Cr-Commit-Position: refs/heads/master@{#16442}
This commit is contained in:
sprang
2017-02-06 03:02:15 -08:00
committed by Commit bot
parent 60f7c633f9
commit 237e1bbf76
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
View File

@ -293,6 +293,7 @@ void RtpPacketizerH264::NextAggregatePacket(RtpPacketToSend* rtp_packet) {
// STAP-A NALU header.
buffer[0] = (packet->header & (kFBit | kNriMask)) | H264::NaluType::kStapA;
size_t index = kNalHeaderSize;
bool is_last_fragment = packet->last_fragment;
while (packet->aggregated) {
const Fragment& fragment = packet->source_fragment;
// Add NAL unit length field.
@ -303,11 +304,12 @@ void RtpPacketizerH264::NextAggregatePacket(RtpPacketToSend* rtp_packet) {
index += fragment.length;
packets_.pop();
input_fragments_.pop_front();
if (packet->last_fragment)
if (is_last_fragment)
break;
packet = &packets_.front();
is_last_fragment = packet->last_fragment;
}
RTC_CHECK(packet->last_fragment);
RTC_CHECK(is_last_fragment);
rtp_packet->SetPayloadSize(index);
}