@@ -1929,28 +1929,23 @@ static int whip_write_packet(AVFormatContext *s, AVPacket *pkt)
19291929 */
19301930 if (media_is_rtcp (whip -> buf , ret )) {
19311931 int ptr = 0 ;
1932- while ( ptr + 4 <= ret ) {
1933- uint8_t pt = whip -> buf [ptr + 1 ] ;
1934- uint8_t fmt = ( whip -> buf [ ptr ] & 0x1f );
1932+ uint8_t pt = whip -> buf [ ptr + 1 ];
1933+ uint8_t fmt = ( whip -> buf [ptr ] & 0x1f ) ;
1934+ if ( ptr + 4 <= ret && pt == 205 && fmt == 1 ) {
19351935 /**
19361936 * Refer to RFC 3550, Section 6.4.1.
19371937 * The length of this RTCP packet in 32-bit words minus one,
19381938 * including the header and any padding.
19391939 */
19401940 int len = (AV_RB16 (& whip -> buf [ptr + 2 ]) + 1 ) * 4 ;
1941- if (ptr + len > ret ) break ;
1942-
1943- if (pt == 205 && fmt == 1 && len >= 12 ) { /* PT=RTPFB, FMT=1 */
1944- int i ;
1941+ if (ptr + len < ret && len >= 12 ) {
1942+ int i = 0 ;
19451943 /* SRTCP index(4 bytes) + HMAC (SRTP_AES128_CM_SHA1_80 10bytes) */
19461944 int srtcp_len = len + 4 + 10 ;
19471945 int ret = ff_srtp_decrypt (& whip -> srtp_recv , whip -> buf , & srtcp_len );
1948- if (ret < 0 ) {
1946+ if (ret < 0 )
19491947 av_log (whip , AV_LOG_ERROR , "WHIP: SRTCP decrypt failed: %d\n" , ret );
1950- // packet is invalid or authentication failed
1951- break ;
1952- }
1953- for (i = 0 ; 14 + i <= len ; i = i + 4 ) {
1948+ while (12 + i < len && ret >= 0 ) {
19541949 /**
19551950 * See https://datatracker.ietf.org/doc/html/rfc4585#section-6.1
19561951 * Handle multi NACKs in bundled packet.
@@ -1971,9 +1966,9 @@ static int whip_write_packet(AVFormatContext *s, AVPacket *pkt)
19711966 } else
19721967 av_log (whip , AV_LOG_INFO , "WHIP: NACK packet, seq=%d, blp=%d, not found, the latest packet seq: %d\n" , seq , blp , whip -> history [whip -> hist_head - 1 ].seq );
19731968 }
1969+ i = i + 4 ;
19741970 }
19751971 }
1976- break ;
19771972 }
19781973 }
19791974 } else if (ret != AVERROR (EAGAIN )) {
0 commit comments