Merge branch '4.0release' into merge/develop

trunk/src/app/srs_app_rtc_source.cpp

@@ -1715,8 +1715,13 @@ bool SrsRtmpFromRtcBridger::check_frame_complete(const uint16_t start, const uin
     for (uint16_t i = 0; i < cnt; ++i) {
         int index = cache_index((start + i));
         SrsRtpPacket* pkt = cache_video_pkts_[index].pkt;
+
+        // fix crash when pkt->payload() if pkt is nullptr;
+        if (!pkt) continue;
+
         SrsRtpFUAPayload2* fua_payload = dynamic_cast<SrsRtpFUAPayload2*>(pkt->payload());
-        if (fua_payload) {
+        if (!fua_payload) continue;
+
         if (fua_payload->start) {
             ++fu_s_c;
         }
@@ -1725,7 +1730,6 @@ bool SrsRtmpFromRtcBridger::check_frame_complete(const uint16_t start, const uin
             ++fu_e_c;
         }
     }
-    }
 
     return fu_s_c == fu_e_c;
 }

trunk/src/kernel/srs_kernel_rtc_rtcp.cpp

@@ -1161,15 +1161,27 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
     if(srs_success != (err = encode_header(buffer))) {
         return srs_error_wrap(err, "encode header");
     }
+
     buffer->write_4bytes(media_ssrc_);
     buffer->write_2bytes(base_sn_);
     buffer->write_2bytes(packet_count);
     buffer->write_3bytes(reference_time_);
     buffer->write_1bytes(fb_pkt_count_);
 
+    int required_size = encoded_chucks_.size() * 2;
+    if(!buffer->require(required_size)) {
+        return srs_error_new(ERROR_RTC_RTCP, "encoded_chucks_[%d] requires %d bytes", (int)encoded_chucks_.size(), required_size);
+    }
+
     for(vector<uint16_t>::iterator it = encoded_chucks_.begin(); it != encoded_chucks_.end(); ++it) {
         buffer->write_2bytes(*it);
     }
+
+    required_size = pkt_deltas_.size() * 2;
+    if(!buffer->require(required_size)) {
+        return srs_error_new(ERROR_RTC_RTCP, "pkt_deltas_[%d] requires %d bytes", (int)pkt_deltas_.size(), required_size);
+    }
+
     for(vector<uint16_t>::iterator it = pkt_deltas_.begin(); it != pkt_deltas_.end(); ++it) {
         if(0 <= *it && 0xFF >= *it) {
             // small delta
@@ -1180,6 +1192,7 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
             buffer->write_2bytes(*it);
         }
     }
+
     while((pkt_len % 4) != 0) {
         buffer->write_1bytes(0);
         pkt_len++;