From e15824e75b5549e53eb5c1ffb79766321ac8d122 Mon Sep 17 00:00:00 2001 From: ThomasVolkert Date: Tue, 26 Aug 2014 14:23:00 +0200 Subject: avformat/rtpdec_h261: Fix sanity checks Fixes mbap and quant Signed-off-by: Michael Niedermayer --- libavformat/rtpdec_h261.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavformat/rtpdec_h261.c') diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c index c1d79a8ace..b902d2aa40 100644 --- a/libavformat/rtpdec_h261.c +++ b/libavformat/rtpdec_h261.c @@ -117,8 +117,8 @@ int ff_h261_handle_packet(AVFormatContext *ctx, PayloadContext *data, sbit = (buf[0] >> 5) & 0x07; ebit = (buf[0] >> 2) & 0x07; gobn = (buf[1] >> 4) & 0x0f; - mbap = ((buf[1] << 1) & 0x1e) | ((buf[1] >> 7) & 0x01); - quant = (buf[1] >> 4) & 0x0f; + mbap = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01); + quant = (buf[2] >> 2) & 0x1f; /* pass the H.261 payload header and continue with the actual payload */ buf += RTP_H261_PAYLOAD_HEADER_SIZE; -- cgit v1.2.3