Merge pull request #210 from kaltura/ngx-mpegts-validate-size

ngx-mpegts: drop corrupt PES packets
kaltura · Jun 25, 2024 · c40941e · c40941e
2 parents 1a4d215 + 4720b8b
commit c40941e
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 18 deletions.
diff --git a/nginx-mpegts-module/src/ngx_ts_stream.c b/nginx-mpegts-module/src/ngx_ts_stream.c
@@ -190,6 +190,26 @@ ngx_ts_byte_read_init(ngx_ts_byte_read_t *br, ngx_chain_t *cl)
 }
 
 
+static size_t
+ngx_ts_byte_left(ngx_ts_byte_read_t *br)
+{
+    size_t        size;
+    ngx_chain_t  *cl;
+
+    cl = br->cl;
+    if (!cl) {
+        return 0;
+    }
+
+    size = cl->buf->last - br->p;
+    for (cl = cl->next; cl; cl = cl->next) {
+        size += cl->buf->last - cl->buf->pos;
+    }
+
+    return size;
+}
+
+
 static ngx_int_t
 ngx_ts_byte_read(ngx_ts_byte_read_t *br, u_char *dst, size_t len)
 {
@@ -865,6 +885,7 @@ ngx_ts_read_pes(ngx_ts_stream_t *ts, ngx_ts_program_t *prog, ngx_ts_es_t *es,
      */
 
     u_char              sid, pfx[3], v8, hlen;
+    size_t              size;
     uint16_t            len, flags, v16;
     uint64_t            pts, dts;
     ngx_uint_t          ptsf;
@@ -891,6 +912,7 @@ ngx_ts_read_pes(ngx_ts_stream_t *ts, ngx_ts_program_t *prog, ngx_ts_es_t *es,
             ngx_log_error(NGX_LOG_WARN, ts->log, 0,
                 "TS invalid continuity counter, cur: %uD, last: %uD, pid: %uD",
                 (uint32_t) es->cont, (uint32_t) h->cont, (uint32_t) h->pid);
+            es->corrupt = 1;
         }
 
         es->cont = h->cont;
@@ -924,14 +946,7 @@ ngx_ts_read_pes(ngx_ts_stream_t *ts, ngx_ts_program_t *prog, ngx_ts_es_t *es,
         return NGX_OK;
     }
 
-    if (len) {
-        pr = br;
-
-        if (ngx_ts_byte_read_skip(&pr, len) == NGX_AGAIN) {
-            return NGX_OK;
-        }
-
-    } else if (b) {
+    if (b) {
         /* wait for PUSI */
         return NGX_OK;
     }
@@ -1067,21 +1082,27 @@ ngx_ts_read_pes(ngx_ts_stream_t *ts, ngx_ts_program_t *prog, ngx_ts_es_t *es,
     }
 
     if (len) {
-        pr = br;
-
-        if (ngx_ts_byte_read_skip(&pr, len) == NGX_AGAIN) {
-            return NGX_OK;
+        size = ngx_ts_byte_left(&br);
+        if (size != len) {
+            ngx_log_error(NGX_LOG_WARN, ts->log, 0,
+                "TS invalid packet size, expected: %uD, actual: %uz",
+                (uint32_t) len, size);
+            es->corrupt = 1;
         }
+    }
+
+    if (!es->corrupt) {
+        es->ptsf = ptsf;
 
-        if (pr.cl) {
-            pr.cl->buf->last = pr.p;
+        if (ngx_ts_run_handlers(NGX_TS_PES, ts, prog, es, br.cl) != NGX_OK) {
+            return NGX_ERROR;
         }
-    }
 
-    es->ptsf = ptsf;
+    } else {
+        ngx_log_debug0(NGX_LOG_DEBUG_CORE, ts->log, 0,
+            "TS dropped corrupt packet");
 
-    if (ngx_ts_run_handlers(NGX_TS_PES, ts, prog, es, br.cl) != NGX_OK) {
-        return NGX_ERROR;
+        es->corrupt = 0;
     }
 
     ngx_ts_free_chain(ts, &es->bufs);

diff --git a/nginx-mpegts-module/src/ngx_ts_stream.h b/nginx-mpegts-module/src/ngx_ts_stream.h
@@ -60,6 +60,7 @@ typedef struct {
     unsigned                      ptsf:1;
     unsigned                      rand:1;
     unsigned                      video:1;
+    unsigned                      corrupt:1;
     ngx_ts_bufs_t                 bufs;  /* ES */
 } ngx_ts_es_t;