From 81ef5192529dd9ff6b7dc34b6528b9d8dafdd100 Mon Sep 17 00:00:00 2001 From: Martin Storsjö Date: Tue, 11 Dec 2012 18:58:59 +0200 Subject: rtpdec: Limit writing to the buffer size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes potential buffer overwrites. Signed-off-by: Martin Storsjö --- libavformat/rtpdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat/rtpdec.c') diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c index 3b03bdaa14..b83a79bdbb 100644 --- a/libavformat/rtpdec.c +++ b/libavformat/rtpdec.c @@ -531,7 +531,7 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt, if (ret < 0) return AVERROR(EAGAIN); if (ret < len) { - s->read_buf_size = len - ret; + s->read_buf_size = FFMIN(len - ret, sizeof(s->buf)); memcpy(s->buf, buf + ret, s->read_buf_size); s->read_buf_index = 0; return 1; -- cgit v1.2.3