Skip to content

Commit

Permalink
fix crash: null ptr in hls+
Browse files Browse the repository at this point in the history
  • Loading branch information
im-pingo committed Dec 2, 2019
1 parent 5809c7c commit f61d926
Show file tree
Hide file tree
Showing 12 changed files with 158 additions and 10 deletions.
1 change: 0 additions & 1 deletion build/download

This file was deleted.

3 changes: 3 additions & 0 deletions hls/ngx_rtmp_hls_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -2144,6 +2144,9 @@ ngx_rtmp_hls_video(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
ngx_log_error(NGX_LOG_ERR, s->log, 0,
"hls: error appending AUD NAL");
}
aud_sent = 1;
break;

case 9:
aud_sent = 1;
break;
Expand Down
62 changes: 58 additions & 4 deletions http/ngx_http_flv_live_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ static void *ngx_http_flv_live_create_loc_conf(ngx_conf_t *cf);
static char *ngx_http_flv_live_merge_loc_conf(ngx_conf_t *cf, void *parent,
void *child);

static u_char ngx_flv_live_header[] = "FLV\x1\x5\0\0\0\x9\0\0\0\0";
static u_char ngx_flv_live_audio_header[] = "FLV\x1\x1\0\0\0\x9\0\0\0\0";
static u_char ngx_flv_live_video_header[] = "FLV\x1\x4\0\0\0\x9\0\0\0\0";
static u_char ngx_flv_live_av_header[] = "FLV\x1\x5\0\0\0\x9\0\0\0\0";

static ngx_keyval_t ngx_http_flv_live_headers[] = {
{ ngx_string("Cache-Control"), ngx_string("no-cache") },
Expand All @@ -41,6 +43,8 @@ typedef struct {
ngx_str_t swf_url;
ngx_str_t tc_url;
ngx_str_t page_url;
ngx_uint_t audio;
ngx_uint_t video;

ngx_rtmp_addr_conf_t *addr_conf;
} ngx_http_flv_live_loc_conf_t;
Expand All @@ -49,7 +53,7 @@ typedef struct {
static ngx_command_t ngx_http_flv_live_commands[] = {

{ ngx_string("flv_live"),
NGX_HTTP_LOC_CONF|NGX_CONF_TAKE12,
NGX_HTTP_LOC_CONF|NGX_CONF_TAKE123,
ngx_http_flv_live,
NGX_HTTP_LOC_CONF_OFFSET,
0,
Expand Down Expand Up @@ -97,11 +101,14 @@ ngx_http_flv_live_send_header(ngx_http_request_t *r)
ngx_keyval_t *h;
ngx_buf_t *b;
ngx_chain_t out;
ngx_http_flv_live_loc_conf_t *hflcf;

if (r->header_sent) {
return NGX_OK;
}

hflcf = ngx_http_get_module_loc_conf(r, ngx_http_flv_live_module);

r->headers_out.status = NGX_HTTP_OK;
r->keepalive = 0; /* set Connection to closed */

Expand All @@ -124,8 +131,32 @@ ngx_http_flv_live_send_header(ngx_http_request_t *r)
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}

b->start = b->pos = ngx_flv_live_header;
b->end = b->last = ngx_flv_live_header + sizeof(ngx_flv_live_header) - 1;
switch (hflcf->audio | (hflcf->video < 1)) {
case 1: // audio only
b->start = b->pos = ngx_flv_live_audio_header;
b->end = b->last = ngx_flv_live_audio_header +
sizeof(ngx_flv_live_audio_header) - 1;
break;

case 2: // video only
b->start = b->pos = ngx_flv_live_video_header;
b->end = b->last = ngx_flv_live_video_header +
sizeof(ngx_flv_live_video_header) - 1;
break;

case 3: // audio and video
b->start = b->pos = ngx_flv_live_av_header;
b->end = b->last = ngx_flv_live_av_header +
sizeof(ngx_flv_live_av_header) - 1;
break;

default:
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
"flv-live: send_header| av header config error.");

return NGX_HTTP_INTERNAL_SERVER_ERROR;
}

b->memory = 1;

out.buf = b;
Expand Down Expand Up @@ -631,6 +662,7 @@ ngx_http_flv_live(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
ngx_http_flv_live_loc_conf_t *hflcf;
ngx_str_t *value, v;
ngx_uint_t i;
ngx_uint_t audio, video;

clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
clcf->handler = ngx_http_flv_live_handler;
Expand All @@ -644,15 +676,37 @@ ngx_http_flv_live(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
return NGX_CONF_ERROR;
}

audio = NGX_CONF_UNSET_UINT;
video = NGX_CONF_UNSET_UINT;

for (i = 2; i < cf->args->nelts; ++i) {
if (ngx_strncmp(value[i].data, "app=", 4) == 0) {
v.data = value[i].data + 4;
v.len = value[i].len - 4;
hflcf->app = v;
} else if (ngx_strncmp(value[i].data, "audio=", 6) == 0) {
v.data = value[i].data + 6;
v.len = value[i].len - 6;
audio = ngx_atoi(v.data, v.len);
} else if (ngx_strncmp(value[i].data, "video=", 6) == 0) {
v.data = value[i].data + 6;
v.len = value[i].len - 6;
video = ngx_atoi(v.data, v.len);
} else {
return NGX_CONF_ERROR;
}
}

if (audio == NGX_CONF_UNSET_UINT) {
audio = 1;
}

if (video == NGX_CONF_UNSET_UINT) {
video = 1;
}

hflcf->audio = audio;
hflcf->video = video;

return NGX_CONF_OK;
}
9 changes: 9 additions & 0 deletions mpegts/ngx_hls_live_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,11 @@ ngx_hls_live_write_playlist(ngx_rtmp_session_t *s, ngx_buf_t *out,
ngx_hls_live_app_conf_t *hacf;

ctx = ngx_rtmp_get_module_ctx(s, ngx_hls_live_module);
if (ctx == NULL) {
ngx_log_error(NGX_LOG_ERR, s->log, 0, "hls-live: playlist| ctx is null");

return NGX_ERROR;
}

ctx->last_time = time(NULL);

Expand Down Expand Up @@ -788,6 +793,10 @@ ngx_hls_live_close_stream(ngx_rtmp_session_t *s, ngx_rtmp_close_stream_t *v)
ngx_del_timer(&ctx->ev);
}

if (ctx->stream == NULL) {
goto next;
}

ngx_rtmp_fire_event(s, NGX_MPEGTS_MSG_CLOSE, NULL, NULL);

ngx_log_debug0(NGX_LOG_DEBUG_RTMP, s->log, 0,
Expand Down
3 changes: 3 additions & 0 deletions mpegts/ngx_mpegts_live_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -1280,6 +1280,9 @@ ngx_mpegts_live_h264_handler(ngx_rtmp_session_t *s, ngx_rtmp_frame_t *f)
ngx_log_error(NGX_LOG_ERR, s->log, 0,
"mpegts-mux: h264_handler| error appending AUD NAL");
}
aud_sent = 1;
break;

case 9:
aud_sent = 1;
break;
Expand Down
3 changes: 3 additions & 0 deletions ngx_live_record.c
Original file line number Diff line number Diff line change
Expand Up @@ -1000,6 +1000,9 @@ ngx_live_record_avc(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
ngx_log_error(NGX_LOG_ERR, s->log, 0,
"record: error appending AUD NAL");
}
aud_sent = 1;
break;

case 9:
aud_sent = 1;
break;
Expand Down
4 changes: 3 additions & 1 deletion ngx_live_relay_static.c
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
#include "ngx_map.h"
#include "ngx_dynamic_conf.h"
#include "ngx_rtmp_dynamic.h"

#include "ngx_dynamic_resolver.h"

static ngx_live_pull_pt next_pull;

Expand Down Expand Up @@ -546,6 +546,8 @@ ngx_live_relay_pull(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
return "invalid port";
}

ngx_dynamic_resolver_add_domain(&url->url.host, cf->cycle);

continue;
}

Expand Down
11 changes: 11 additions & 0 deletions ngx_rtmp_access_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -410,6 +410,17 @@ ngx_rtmp_access_rule(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
break;
}

rule = ngx_array_push(&ascf->rules);
if (rule == NULL) {
return NGX_CONF_ERROR;
}

rule->mask = cidr.u.in.mask;
rule->addr = cidr.u.in.addr;
rule->deny = (value[0].data[0] == 'd') ? 1 : 0;
rule->flags = flags;

break;
/* "all" passes through */
#endif

Expand Down
19 changes: 19 additions & 0 deletions ngx_rtmp_amf.c
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,10 @@ ngx_rtmp_amf_read(ngx_rtmp_amf_ctx_t *ctx, ngx_rtmp_amf_elt_t *elts,
case NGX_DONE:
if (elts->type & NGX_RTMP_AMF_OPTIONAL) {
return NGX_OK;
} else {
return NGX_ERROR;
}
break;
case NGX_ERROR:
return NGX_ERROR;
}
Expand Down Expand Up @@ -398,6 +401,13 @@ ngx_rtmp_amf_read(ngx_rtmp_amf_ctx_t *ctx, ngx_rtmp_amf_elt_t *elts,
if (ngx_rtmp_amf_get(ctx, &max_index, 4) != NGX_OK) {
return NGX_ERROR;
}
if (ngx_rtmp_amf_read_object(ctx, data,
data && elts ? elts->len / sizeof(ngx_rtmp_amf_elt_t) : 0
) != NGX_OK)
{
return NGX_ERROR;
}
break;

case NGX_RTMP_AMF_OBJECT:
if (ngx_rtmp_amf_read_object(ctx, data,
Expand Down Expand Up @@ -593,6 +603,15 @@ ngx_rtmp_amf_write(ngx_rtmp_amf_ctx_t *ctx,
return NGX_ERROR;
}

type8 = NGX_RTMP_AMF_END;
if (ngx_rtmp_amf_write_object(ctx, data,
elts[n].len / sizeof(ngx_rtmp_amf_elt_t)) != NGX_OK
|| ngx_rtmp_amf_put(ctx, &type8, 1) != NGX_OK)
{
return NGX_ERROR;
}
break;

case NGX_RTMP_AMF_OBJECT:
type8 = NGX_RTMP_AMF_END;
if (ngx_rtmp_amf_write_object(ctx, data,
Expand Down
16 changes: 16 additions & 0 deletions ngx_rtmp_eval.c
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,19 @@ ngx_rtmp_eval(void *ctx, ngx_str_t *in, ngx_rtmp_eval_t **e, ngx_str_t *out,

name.len = p - name.data;
ngx_rtmp_eval_append_var(ctx, &b, e, &name, log);
switch (c) {
case '$':
name.data = p + 1;
state = NAME;
continue;
case '\\':
state = ESCAPE;
continue;
}

ngx_rtmp_eval_append(&b, &c, 1, log);
state = NORMAL;
break;

case NORMAL:
switch (c) {
Expand All @@ -165,6 +178,9 @@ ngx_rtmp_eval(void *ctx, ngx_str_t *in, ngx_rtmp_eval_t **e, ngx_str_t *out,
state = ESCAPE;
continue;
}
ngx_rtmp_eval_append(&b, &c, 1, log);
state = NORMAL;
break;

case ESCAPE:
ngx_rtmp_eval_append(&b, &c, 1, log);
Expand Down
20 changes: 20 additions & 0 deletions ngx_rtmp_init.c
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,22 @@ ngx_rtmp_init_connection(ngx_connection_t *c)
case AF_UNIX:
unix_socket = 1;

sin = (struct sockaddr_in *) sa;

addr = port->addrs;

/* the last address is "*" */

for (i = 0; i < port->naddrs - 1; i++) {
if (addr[i].addr == sin->sin_addr.s_addr) {
break;
}
}

addr_conf = &addr[i].conf;

break;

default: /* AF_INET */
sin = (struct sockaddr_in *) sa;

Expand Down Expand Up @@ -155,6 +171,9 @@ ngx_rtmp_init_connection(ngx_connection_t *c)

case AF_UNIX:
unix_socket = 1;
addr = port->addrs;
addr_conf = &addr[0].conf;
break;

default: /* AF_INET */
addr = port->addrs;
Expand Down Expand Up @@ -373,6 +392,7 @@ ngx_rtmp_finalize_session(ngx_rtmp_session_t *s)

if (s->live_type == NGX_HLS_LIVE) {
ngx_rtmp_finalize_fake_session(s);
return;
}

if (s->destroyed) {
Expand Down
17 changes: 13 additions & 4 deletions ngx_rtmp_oclp_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -463,6 +463,11 @@ ngx_rtmp_oclp_create_event(ngx_conf_t *cf, ngx_rtmp_oclp_event_t *event,

event->url.len = values[i].len;
event->url.data = values[i].data;
if (values[i].data[values[i].len - 1] != '/') {
event->url.data = ngx_pcalloc(cf->pool, values[i].len + 1);
event->url.len = values[i].len + 1;
ngx_snprintf(event->url.data, event->url.len, "%V/", &values[i]);
}

if (ngx_parse_request_url(&ru, &event->url) != NGX_OK) {
ngx_conf_log_error(NGX_LOG_WARN, cf, 0, "request url format error");
Expand Down Expand Up @@ -738,13 +743,17 @@ ngx_rtmp_oclp_common_url(ngx_str_t *url, ngx_rtmp_session_t *s,
buf = p;

if (ru.args.len) { // url already has args
p = ngx_snprintf(buf, len, "&call=%s&act=%s&domain=%V&app=%V&name=%V",
p = ngx_snprintf(buf, len,
"&call=%s&act=%s&domain=%V&app=%V&name=%V&clientid=%D",
ngx_rtmp_oclp_app_type[nctx->type],
ngx_rtmp_oclp_stage[stage], &s->domain, &s->app, &s->name);
ngx_rtmp_oclp_stage[stage],
&s->domain, &s->app, &s->name, s->number);
} else {
p = ngx_snprintf(buf, len, "?call=%s&act=%s&domain=%V&app=%V&name=%V",
p = ngx_snprintf(buf, len,
"?call=%s&act=%s&domain=%V&app=%V&name=%V&clientid=%D",
ngx_rtmp_oclp_app_type[nctx->type],
ngx_rtmp_oclp_stage[stage], &s->domain, &s->app, &s->name);
ngx_rtmp_oclp_stage[stage],
&s->domain, &s->app, &s->name, s->number);
}
len -= p - buf;
buf = p;
Expand Down

0 comments on commit f61d926

Please sign in to comment.