Skip to content

Commit eeb8e6a

Browse files
committed
Add boundary checks
1 parent 42bff72 commit eeb8e6a

File tree

1 file changed

+23
-9
lines changed

1 file changed

+23
-9
lines changed

alvr/server/cpp/alvr_server/ClientConnection.cpp

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ void sendHeaders(uint8_t **buf, int *len, int nalNum) {
3232
int headersLen = 0;
3333
int foundHeaders = -1; // Offset by 1 header to find the length until the next header
3434
while (b != end) {
35-
if (memcmp(b, NAL_HEADER, sizeof(NAL_HEADER)) == 0) {
35+
if (b + sizeof(NAL_HEADER) <= end && memcmp(b, NAL_HEADER, sizeof(NAL_HEADER)) == 0) {
3636
foundHeaders++;
3737
if (foundHeaders == nalNum) {
3838
break;
@@ -58,11 +58,16 @@ void processH264Nals(uint8_t **buf, int *len) {
5858
uint8_t *b = *buf;
5959
int l = *len;
6060
uint8_t nalType = b[4] & 0x1F;
61-
61+
6262
if (nalType == H264_NAL_TYPE_AUD) {
63-
b += sizeof(NAL_HEADER) + 2;
64-
l -= sizeof(NAL_HEADER) + 2;
65-
nalType = b[4] & 0x1F;
63+
uint8_t nalSize = sizeof(NAL_HEADER) + 2;
64+
if (l >= nalSize) {
65+
b += nalSize;
66+
l -= nalSize;
67+
}
68+
if (l > sizeof(NAL_HEADER)) {
69+
nalType = b[4] & 0x1F;
70+
}
6671
}
6772
if (nalType == H264_NAL_TYPE_SPS) {
6873
sendHeaders(&b, &l, 2); // 2 headers SPS and PPS
@@ -75,11 +80,16 @@ void processH265Nals(uint8_t **buf, int *len) {
7580
uint8_t *b = *buf;
7681
int l = *len;
7782
uint8_t nalType = (b[4] >> 1) & 0x3F;
78-
83+
7984
if (nalType == H265_NAL_TYPE_AUD) {
80-
b += sizeof(NAL_HEADER) + 3;
81-
l -= sizeof(NAL_HEADER) + 3;
82-
nalType = (b[4] >> 1) & 0x3F;
85+
uint8_t nalSize = sizeof(NAL_HEADER) + 3;
86+
if (l >= nalSize) {
87+
b += nalSize;
88+
l -= nalSize;
89+
}
90+
if (l > sizeof(NAL_HEADER)) {
91+
nalType = (b[4] >> 1) & 0x3F;
92+
}
8393
}
8494
if (nalType == H265_NAL_TYPE_VPS) {
8595
sendHeaders(&b, &l, 3); // 3 headers VPS, SPS and PPS
@@ -92,6 +102,10 @@ void ClientConnection::SendVideo(uint8_t *buf, int len, uint64_t targetTimestamp
92102
// Report before the frame is packetized
93103
ReportEncoded(targetTimestampNs);
94104

105+
if (len < sizeof(NAL_HEADER)) {
106+
return;
107+
}
108+
95109
int codec = Settings::Instance().m_codec;
96110
if (codec == ALVR_CODEC_H264) {
97111
processH264Nals(&buf, &len);

0 commit comments

Comments
 (0)