Improve checks for runt video packets

Since we always allocate fixed size these aren't likely to be exploitable,
but we ought to fix them anyway. Worst case, we will just read some garbage
and generate corrupt video output.
This commit is contained in:
Cameron Gutman
2023-09-12 22:44:45 -05:00
parent 171858c2e7
commit ec6713fd80
3 changed files with 30 additions and 9 deletions
+5
View File
@@ -539,6 +539,11 @@ int RtpvAddPacket(PRTP_VIDEO_QUEUE queue, PRTP_PACKET packet, int length, PRTPV_
dataOffset += 4; // 2 additional fields
}
if (length < dataOffset + (int)sizeof(NV_VIDEO_PACKET)) {
// Reject packets that are too small to fit a NV_VIDEO_PACKET header
return RTPF_RET_REJECTED;
}
PNV_VIDEO_PACKET nvPacket = (PNV_VIDEO_PACKET)(((char*)packet) + dataOffset);
nvPacket->streamPacketIndex = LE32(nvPacket->streamPacketIndex);