Skip to content

Commit 03b1e28

Browse files
committed
Add boundary checks
1 parent 42bff72 commit 03b1e28

File tree

1 file changed

+9
-5
lines changed

1 file changed

+9
-5
lines changed

alvr/server/cpp/alvr_server/ClientConnection.cpp

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ void sendHeaders(uint8_t **buf, int *len, int nalNum) {
3232
int headersLen = 0;
3333
int foundHeaders = -1; // Offset by 1 header to find the length until the next header
3434
while (b != end) {
35-
if (memcmp(b, NAL_HEADER, sizeof(NAL_HEADER)) == 0) {
35+
if (b + sizeof(NAL_HEADER) <= end && memcmp(b, NAL_HEADER, sizeof(NAL_HEADER)) == 0) {
3636
foundHeaders++;
3737
if (foundHeaders == nalNum) {
3838
break;
@@ -58,8 +58,8 @@ void processH264Nals(uint8_t **buf, int *len) {
5858
uint8_t *b = *buf;
5959
int l = *len;
6060
uint8_t nalType = b[4] & 0x1F;
61-
62-
if (nalType == H264_NAL_TYPE_AUD) {
61+
62+
if (nalType == H264_NAL_TYPE_AUD && l > sizeof(NAL_HEADER) * 2 + 2) {
6363
b += sizeof(NAL_HEADER) + 2;
6464
l -= sizeof(NAL_HEADER) + 2;
6565
nalType = b[4] & 0x1F;
@@ -75,8 +75,8 @@ void processH265Nals(uint8_t **buf, int *len) {
7575
uint8_t *b = *buf;
7676
int l = *len;
7777
uint8_t nalType = (b[4] >> 1) & 0x3F;
78-
79-
if (nalType == H265_NAL_TYPE_AUD) {
78+
79+
if (nalType == H265_NAL_TYPE_AUD && l > sizeof(NAL_HEADER) * 2 + 3) {
8080
b += sizeof(NAL_HEADER) + 3;
8181
l -= sizeof(NAL_HEADER) + 3;
8282
nalType = (b[4] >> 1) & 0x3F;
@@ -92,6 +92,10 @@ void ClientConnection::SendVideo(uint8_t *buf, int len, uint64_t targetTimestamp
9292
// Report before the frame is packetized
9393
ReportEncoded(targetTimestampNs);
9494

95+
if (len < sizeof(NAL_HEADER)) {
96+
return;
97+
}
98+
9599
int codec = Settings::Instance().m_codec;
96100
if (codec == ALVR_CODEC_H264) {
97101
processH264Nals(&buf, &len);

0 commit comments

Comments
 (0)