On Sat, 21 Sep 2013, Luca Barbato wrote:
And fix the AMF_DATA_TYPE_ARRAY parsing while at it.A MIXEDARRAY type, as the ARRAY, store the number of elements in an uint32 before the list. The ARRAY is strict and does not have an OBJECT terminator, MIXEDARRAY behaves like an OBJECT type and a different than stated number of element can be present. --- A bit more complete. libavformat/rtmppkt.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index 922ca3e..ca1ef75 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -370,19 +370,22 @@ void ff_rtmp_packet_destroy(RTMPPacket *pkt) int ff_amf_tag_size(const uint8_t *data, const uint8_t *data_end) { const uint8_t *base = data; + unsigned nb = -1; + AMFDataType type; if (data >= data_end) return -1; - switch (*data++) { + switch ((type = *data++)) { case AMF_DATA_TYPE_NUMBER: return 9; case AMF_DATA_TYPE_BOOL: return 2; case AMF_DATA_TYPE_STRING: return 3 + AV_RB16(data); case AMF_DATA_TYPE_LONG_STRING: return 5 + AV_RB32(data); case AMF_DATA_TYPE_NULL: return 1; + case AMF_DATA_TYPE_MIXEDARRAY: case AMF_DATA_TYPE_ARRAY: - data += 4; + nb = bytestream_get_be32(&data); case AMF_DATA_TYPE_OBJECT: - for (;;) { + while (nb-- > 0 || type != AMF_DATA_TYPE_ARRAY) { int size = bytestream_get_be16(&data);
I'm still not sure this is totally right for AMF_DATA_TYPE_ARRAY - this is used for parsing (or skipping past) the string names for each of the elements in an OBJECT or a MIXEDARRAY, but an ARRAY doesn't have string names for each of the elements at all.
// Martin _______________________________________________ libav-devel mailing list libav-devel@libav.org https://lists.libav.org/mailman/listinfo/libav-devel
