amass/ZLMediaKit
1
0
Fork 0
mirror of https://github.com/ZLMediaKit/ZLMediaKit.git synced 2024-11-29 14:45:55 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

修复aac rtp解包内存越界的bug

Browse Source
This commit is contained in:
xiongziliang 2020-03-11 18:52:28 +08:00
parent f76a203768
commit 2b592780ad
2 changed files with 37 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
src/Extension/AACRtp.cpp
View File

@ -24,6 +24,7 @@
* SOFTWARE. * SOFTWARE.
*/ */
#include "AACRtp.h" #include "AACRtp.h"
#define ADTS_HEADER_LEN 7
namespace mediakit{ namespace mediakit{
@ -91,8 +92,8 @@ AACRtpDecoder::AACRtpDecoder() {
AACFrame::Ptr AACRtpDecoder::obtainFrame() { AACFrame::Ptr AACRtpDecoder::obtainFrame() {
//从缓存池重新申请对象，防止覆盖已经写入环形缓存的对象 //从缓存池重新申请对象，防止覆盖已经写入环形缓存的对象
auto frame = ResourcePoolHelper<AACFrame>::obtainObj(); auto frame = ResourcePoolHelper<AACFrame>::obtainObj();
frame->aac_frame_length = 7; frame->aac_frame_length = ADTS_HEADER_LEN;
frame->iPrefixSize = 7; frame->iPrefixSize = ADTS_HEADER_LEN;
if(frame->syncword == 0 && !_aac_cfg.empty()) { if(frame->syncword == 0 && !_aac_cfg.empty()) {
makeAdtsHeader(_aac_cfg,*frame); makeAdtsHeader(_aac_cfg,*frame);
} }
@ -100,70 +101,45 @@ AACFrame::Ptr AACRtpDecoder::obtainFrame() {
} }
bool AACRtpDecoder::inputRtp(const RtpPacket::Ptr &rtppack, bool key_pos) { bool AACRtpDecoder::inputRtp(const RtpPacket::Ptr &rtppack, bool key_pos) {
// 获取rtp数据长度 //rtp数据开始部分
int length = rtppack->size() - rtppack->offset; uint8_t *ptr = (uint8_t *) rtppack->data() + rtppack->offset;
//rtp数据末尾
const uint8_t *end = (uint8_t *) rtppack->data() + rtppack->size();
// 获取rtp数据 //首2字节表示Au-Header的个数，单位bit，所以除以16得到Au-Header个数
const uint8_t *rtp_packet_buf = (uint8_t *)rtppack->data() + rtppack->offset; const uint16_t au_header_count = ((ptr[0] << 8) | ptr[1]) >> 4;
//忽略Au-Header区
ptr += 2 + au_header_count * 2;
do static const uint32_t max_size = sizeof(AACFrame::buffer) - ADTS_HEADER_LEN;
{ while (ptr < end) {
// 查询头部的偏移，每次2字节 auto size = std::min(max_size, (uint32_t) (end - ptr));
uint32_t au_header_offset = 0; if (_adts->aac_frame_length + size > sizeof(AACFrame::buffer)) {
//首2字节表示Au-Header的长度，单位bit，所以除以16得到Au-Header字节数 //数据太多了，先清空
const uint16_t au_header_length = (((rtp_packet_buf[au_header_offset] << 8) | rtp_packet_buf[au_header_offset + 1]) >> 4); flushData();
au_header_offset += 2;
//assert(length > (2 + au_header_length * 2));
if (length < (2 + au_header_length * 2))
break;
// 存放每一个aac帧长度
std::vector<uint32_t > vec_aac_len;
for (int i = 0; i < au_header_length; ++i)
{
// 之后的2字节是AU_HEADER
const uint16_t au_header = ((rtp_packet_buf[au_header_offset] << 8) | rtp_packet_buf[au_header_offset + 1]);
// 其中高13位表示一帧AAC负载的字节长度，低3位无用
uint32_t nAac = (au_header >> 3);
vec_aac_len.push_back(nAac);
au_header_offset += 2;
} }
//追加aac数据
// 真正aac负载开始处 memcpy(_adts->buffer + _adts->aac_frame_length, ptr, size);
const uint8_t *rtp_packet_payload = rtp_packet_buf + au_header_offset; _adts->aac_frame_length += size;
// 载荷查找
uint32_t next_aac_payload_offset = 0;
for (int j = 0; j < au_header_length; ++j)
{
// 当前aac包长度
const uint32_t cur_aac_payload_len = vec_aac_len.at(j);
if (_adts->aac_frame_length + cur_aac_payload_len > sizeof(AACFrame::buffer)) {
_adts->aac_frame_length = 7;
WarnL << "aac负载数据太长";
return false;
}
// 提取每一包aac载荷数据
memcpy(_adts->buffer + _adts->aac_frame_length, rtp_packet_payload + next_aac_payload_offset, cur_aac_payload_len);
_adts->aac_frame_length += (cur_aac_payload_len);
if (rtppack->mark == true) {
_adts->timeStamp = rtppack->timeStamp; _adts->timeStamp = rtppack->timeStamp;
writeAdtsHeader(*_adts, _adts->buffer); ptr += size;
onGetAAC(_adts);
} }
next_aac_payload_offset += cur_aac_payload_len; if (rtppack->mark) {
//最后一个rtp分片
flushData();
} }
} while (0);
return false; return false;
} }
void AACRtpDecoder::onGetAAC(const AACFrame::Ptr &frame) {
//写入环形缓存 void AACRtpDecoder::flushData() {
RtpCodec::inputFrame(frame); if(_adts->aac_frame_length == ADTS_HEADER_LEN){
//没有有效数据
return;
}
writeAdtsHeader(*_adts, _adts->buffer);
RtpCodec::inputFrame(_adts);
_adts = obtainFrame(); _adts = obtainFrame();
} }

2
src/Extension/AACRtp.h
View File

@ -56,8 +56,8 @@ public:
protected: protected:
AACRtpDecoder(); AACRtpDecoder();
private: private:
void onGetAAC(const AACFrame::Ptr &frame);
AACFrame::Ptr obtainFrame(); AACFrame::Ptr obtainFrame();
void flushData();
private: private:
AACFrame::Ptr _adts; AACFrame::Ptr _adts;
string _aac_cfg; string _aac_cfg;