rtpvorbis/theoradepay: Fix handling of fragmented packets

This was broken in b1089fb5 by not considering the full packet length of a
fragmented packet but only the length of the first one.

https://bugzilla.gnome.org/show_bug.cgi?id=754417

gst/rtp/gstrtptheoradepay.c

@@ -407,7 +407,6 @@ gst_rtp_theora_depay_process (GstRTPBaseDepayload * depayload,
 
   rtptheoradepay = GST_RTP_THEORA_DEPAY (depayload);
 
-  payload = gst_rtp_buffer_get_payload (rtp);
   payload_len = gst_rtp_buffer_get_payload_len (rtp);
 
   GST_DEBUG_OBJECT (depayload, "got RTP packet of size %d", payload_len);
@@ -462,7 +461,6 @@ gst_rtp_theora_depay_process (GstRTPBaseDepayload * depayload,
   /* fragmented packets, assemble */
   if (F != 0) {
     GstBuffer *vdata;
-    guint headerskip;
 
     if (F == 1) {
       /* if we start a packet, clear adapter and start assembling. */
@@ -474,10 +472,8 @@ gst_rtp_theora_depay_process (GstRTPBaseDepayload * depayload,
     if (!rtptheoradepay->assembling)
       goto no_output;
 
-    /* first assembled packet, reuse 2 bytes to store the length */
-    headerskip = (F == 1 ? 4 : 6);
     /* skip header and length. */
-    vdata = gst_rtp_buffer_get_payload_subbuffer (rtp, headerskip, -1);
+    vdata = gst_rtp_buffer_get_payload_subbuffer (rtp, 6, -1);
 
     GST_DEBUG_OBJECT (depayload, "assemble theora packet");
     gst_adapter_push (rtptheoradepay->adapter, vdata);
@@ -487,9 +483,10 @@ gst_rtp_theora_depay_process (GstRTPBaseDepayload * depayload,
       goto no_output;
 
     /* construct assembled buffer */
-    payload_buffer =
-        gst_adapter_take_buffer (rtptheoradepay->adapter, payload_len);
+    length = gst_adapter_available (rtptheoradepay->adapter);
+    payload_buffer = gst_adapter_take_buffer (rtptheoradepay->adapter, length);
   } else {
+    length = 0;
     payload_buffer = gst_rtp_buffer_get_payload_subbuffer (rtp, 4, -1);
   }
 
@@ -519,8 +516,15 @@ gst_rtp_theora_depay_process (GstRTPBaseDepayload * depayload,
    * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*
    */
   while (payload_len >= 2) {
-    payload += 2;
-    payload_len -= 2;
+    /* If length is not 0, we have a reassembled packet for which we
+     * calculated the length already and don't have to skip over the
+     * length field anymore
+     */
+    if (length == 0) {
+      length = GST_READ_UINT16_BE (payload);
+      payload += 2;
+      payload_len -= 2;
+    }
 
     GST_DEBUG_OBJECT (depayload, "read length %u, avail: %d", length,
         payload_len);

gst/rtp/gstrtpvorbisdepay.c

@@ -454,7 +454,6 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
 
   rtpvorbisdepay = GST_RTP_VORBIS_DEPAY (depayload);
 
-  payload = gst_rtp_buffer_get_payload (rtp);
   payload_len = gst_rtp_buffer_get_payload_len (rtp);
 
   GST_DEBUG_OBJECT (depayload, "got RTP packet of size %d", payload_len);
@@ -463,6 +462,7 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
   if (G_UNLIKELY (payload_len < 4))
     goto packet_short;
 
+  payload = gst_rtp_buffer_get_payload (rtp);
   header = GST_READ_UINT32_BE (payload);
   /*
    *  0                   1                   2                   3
@@ -510,7 +510,6 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
   /* fragmented packets, assemble */
   if (F != 0) {
     GstBuffer *vdata;
-    guint headerskip;
 
     if (F == 1) {
       /* if we start a packet, clear adapter and start assembling. */
@@ -522,10 +521,8 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
     if (!rtpvorbisdepay->assembling)
       goto no_output;
 
-    /* first assembled packet, reuse 2 bytes to store the length */
-    headerskip = (F == 1 ? 4 : 6);
     /* skip header and length. */
-    vdata = gst_rtp_buffer_get_payload_subbuffer (rtp, headerskip, -1);
+    vdata = gst_rtp_buffer_get_payload_subbuffer (rtp, 6, -1);
 
     GST_DEBUG_OBJECT (depayload, "assemble vorbis packet");
     gst_adapter_push (rtpvorbisdepay->adapter, vdata);
@@ -535,10 +532,11 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
       goto no_output;
 
     /* construct assembled buffer */
-    payload_buffer =
-        gst_adapter_take_buffer (rtpvorbisdepay->adapter, payload_len);
+    length = gst_adapter_available (rtpvorbisdepay->adapter);
+    payload_buffer = gst_adapter_take_buffer (rtpvorbisdepay->adapter, length);
   } else {
     payload_buffer = gst_rtp_buffer_get_payload_subbuffer (rtp, 4, -1);
+    length = 0;
   }
 
   GST_DEBUG_OBJECT (depayload, "assemble done");
@@ -567,10 +565,15 @@ gst_rtp_vorbis_depay_process (GstRTPBaseDepayload * depayload,
    * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*
    */
   while (payload_len > 2) {
-    length = GST_READ_UINT16_BE (payload);
-
-    payload += 2;
-    payload_len -= 2;
+    /* If length is not 0, we have a reassembled packet for which we
+     * calculated the length already and don't have to skip over the
+     * length field anymore
+     */
+    if (length == 0) {
+      length = GST_READ_UINT16_BE (payload);
+      payload += 2;
+      payload_len -= 2;
+    }
 
     GST_DEBUG_OBJECT (depayload, "read length %u, avail: %d", length,
         payload_len);