From ee23e3abed1b64665ad497fe13ea0c392648e437 Mon Sep 17 00:00:00 2001
From: johzzy <hellojinqiang@gmail.com>
Date: Sun, 26 Sep 2021 17:01:53 +0800
Subject: [PATCH 1/2] fix some crash in rtc. (#2545)

---
 trunk/src/app/srs_app_rtc_source.cpp     | 4 ++++
 trunk/src/kernel/srs_kernel_rtc_rtcp.cpp | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/trunk/src/app/srs_app_rtc_source.cpp b/trunk/src/app/srs_app_rtc_source.cpp
index 497b263be..77ba4d11f 100644
--- a/trunk/src/app/srs_app_rtc_source.cpp
+++ b/trunk/src/app/srs_app_rtc_source.cpp
@@ -1715,6 +1715,10 @@ bool SrsRtmpFromRtcBridger::check_frame_complete(const uint16_t start, const uin
     for (uint16_t i = 0; i < cnt; ++i) {
         int index = cache_index((start + i));
         SrsRtpPacket* pkt = cache_video_pkts_[index].pkt;
+        if (!pkt) {
+            // fix crash when pkt->payload() if pkt is nullptr;
+            continue;
+        }
         SrsRtpFUAPayload2* fua_payload = dynamic_cast<SrsRtpFUAPayload2*>(pkt->payload());
         if (fua_payload) {
             if (fua_payload->start) {
diff --git a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
index ab5014a47..54494527c 100644
--- a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
+++ b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
@@ -1167,9 +1167,17 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
     buffer->write_3bytes(reference_time_);
     buffer->write_1bytes(fb_pkt_count_);
 
+    int required_size = encoded_chucks_.size() * 2;
+    if(!buffer->require(required_size)) {
+        return srs_error_new(ERROR_RTC_RTCP, "encoded_chucks_[%d] requires %d bytes", (int)encoded_chucks_.size(), required_size);
+    }
     for(vector<uint16_t>::iterator it = encoded_chucks_.begin(); it != encoded_chucks_.end(); ++it) {
         buffer->write_2bytes(*it);
     }
+    required_size = pkt_deltas_.size() * 2;
+    if(!buffer->require(required_size)) {
+        return srs_error_new(ERROR_RTC_RTCP, "pkt_deltas_[%d] requires %d bytes", (int)pkt_deltas_.size(), required_size);
+    }
     for(vector<uint16_t>::iterator it = pkt_deltas_.begin(); it != pkt_deltas_.end(); ++it) {
         if(0 <= *it && 0xFF >= *it) {
             // small delta

From ad4b648ed2e5e7d8b30c713b77628cf8614073e6 Mon Sep 17 00:00:00 2001
From: winlin <winlin@vip.126.com>
Date: Sun, 26 Sep 2021 17:07:54 +0800
Subject: [PATCH 2/2] For #2545, Refine code with space lines.

---
 trunk/src/app/srs_app_rtc_source.cpp     | 24 ++++++++++++------------
 trunk/src/kernel/srs_kernel_rtc_rtcp.cpp |  5 +++++
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/trunk/src/app/srs_app_rtc_source.cpp b/trunk/src/app/srs_app_rtc_source.cpp
index 77ba4d11f..371b4d3ff 100644
--- a/trunk/src/app/srs_app_rtc_source.cpp
+++ b/trunk/src/app/srs_app_rtc_source.cpp
@@ -1715,19 +1715,19 @@ bool SrsRtmpFromRtcBridger::check_frame_complete(const uint16_t start, const uin
     for (uint16_t i = 0; i < cnt; ++i) {
         int index = cache_index((start + i));
         SrsRtpPacket* pkt = cache_video_pkts_[index].pkt;
-        if (!pkt) {
-            // fix crash when pkt->payload() if pkt is nullptr;
-            continue;
-        }
-        SrsRtpFUAPayload2* fua_payload = dynamic_cast<SrsRtpFUAPayload2*>(pkt->payload());
-        if (fua_payload) {
-            if (fua_payload->start) {
-                ++fu_s_c;
-            }
 
-            if (fua_payload->end) {
-                ++fu_e_c;
-            }
+        // fix crash when pkt->payload() if pkt is nullptr;
+        if (!pkt) continue;
+
+        SrsRtpFUAPayload2* fua_payload = dynamic_cast<SrsRtpFUAPayload2*>(pkt->payload());
+        if (!fua_payload) continue;
+
+        if (fua_payload->start) {
+            ++fu_s_c;
+        }
+
+        if (fua_payload->end) {
+            ++fu_e_c;
         }
     }
 
diff --git a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
index 54494527c..d3febbc59 100644
--- a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
+++ b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp
@@ -1161,6 +1161,7 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
     if(srs_success != (err = encode_header(buffer))) {
         return srs_error_wrap(err, "encode header");
     }
+
     buffer->write_4bytes(media_ssrc_);
     buffer->write_2bytes(base_sn_);
     buffer->write_2bytes(packet_count);
@@ -1171,13 +1172,16 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
     if(!buffer->require(required_size)) {
         return srs_error_new(ERROR_RTC_RTCP, "encoded_chucks_[%d] requires %d bytes", (int)encoded_chucks_.size(), required_size);
     }
+
     for(vector<uint16_t>::iterator it = encoded_chucks_.begin(); it != encoded_chucks_.end(); ++it) {
         buffer->write_2bytes(*it);
     }
+
     required_size = pkt_deltas_.size() * 2;
     if(!buffer->require(required_size)) {
         return srs_error_new(ERROR_RTC_RTCP, "pkt_deltas_[%d] requires %d bytes", (int)pkt_deltas_.size(), required_size);
     }
+
     for(vector<uint16_t>::iterator it = pkt_deltas_.begin(); it != pkt_deltas_.end(); ++it) {
         if(0 <= *it && 0xFF >= *it) {
             // small delta
@@ -1188,6 +1192,7 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer)
             buffer->write_2bytes(*it);
         }
     }
+
     while((pkt_len % 4) != 0) {
         buffer->write_1bytes(0);
         pkt_len++;