From 38fd547b08f64ea723a2e9fd5fada4e62551373f Mon Sep 17 00:00:00 2001
From: xiongziliang <771730766@qq.com>
Date: Mon, 4 Mar 2019 09:44:10 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Drtmp=E5=A4=8D=E5=90=88?=
 =?UTF-8?q?=E5=8C=85=E8=BE=B9=E7=95=8C=E6=A3=80=E6=9F=A5bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Rtmp/RtmpProtocol.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/Rtmp/RtmpProtocol.cpp b/src/Rtmp/RtmpProtocol.cpp
index bd15f24e..22f8415b 100644
--- a/src/Rtmp/RtmpProtocol.cpp
+++ b/src/Rtmp/RtmpProtocol.cpp
@@ -679,8 +679,8 @@ void RtmpProtocol::handle_rtmpChunk(RtmpPacket& chunkData) {
 			break;
 		case MSG_AGGREGATE: {
 			auto ptr = (uint8_t*)chunkData.strBuf.data();
-			auto ptr_tail = (uint8_t*)&chunkData.strBuf.back();
-			while(ptr < ptr_tail - 8 - 3){
+			auto ptr_tail = ptr + chunkData.strBuf.length() ;
+			while(ptr + 8 + 3 < ptr_tail){
 				auto type = *ptr;
 				ptr += 1;
 				auto size = load_be24(ptr);
@@ -717,9 +717,10 @@ void RtmpProtocol::handle_rtmpChunk(RtmpPacket& chunkData) {
 				//参考FFmpeg多拷贝了4个字节
 				size += 4;
 				if(ptr + size > ptr_tail){
+//				    ErrorL << ptr + size << " " << ptr_tail << " " << ptr_tail - ptr - size;
 					break;
 				}
-//				DebugL << (int)type << " " << size << " " << ts << " " << hexdump(ptr,size > 32 ? 32 : size);
+//				DebugL << (int)type << " " << size << " " << ts << " " << chunkData.timeStamp << " " << ptr_tail - ptr;
 				RtmpPacket sub_packet ;
 				sub_packet.strBuf.resize(size);
 				memcpy((char *)sub_packet.strBuf.data(),ptr,size);
@@ -731,6 +732,7 @@ void RtmpProtocol::handle_rtmpChunk(RtmpPacket& chunkData) {
 				handle_rtmpChunk(sub_packet);
 				ptr += size;
 			}
+//			InfoL << ptr_tail - ptr;
 		}
 			break;
 		default: