From 5245adb963e35660a70115c437cd67ea0c398885 Mon Sep 17 00:00:00 2001 From: Martin Storsjö Date: Fri, 4 May 2012 22:45:11 +0300 Subject: rtpdec_h264: Check the available data length before reading MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This makes sure the length is checked for STAP-A type packets. Signed-off-by: Martin Storsjö --- libavformat/rtpdec_h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavformat/rtpdec_h264.c') diff --git a/libavformat/rtpdec_h264.c b/libavformat/rtpdec_h264.c index 51447f9703..8b56ada397 100644 --- a/libavformat/rtpdec_h264.c +++ b/libavformat/rtpdec_h264.c @@ -218,7 +218,7 @@ static int h264_handle_packet(AVFormatContext *ctx, const uint8_t *src= buf; int src_len= len; - do { + while (src_len > 2) { uint16_t nal_size = AV_RB16(src); // this going to be a problem if unaligned (can it be?) // consume the length of the aggregate... @@ -252,7 +252,7 @@ static int h264_handle_packet(AVFormatContext *ctx, if (src_len < 0) av_log(ctx, AV_LOG_ERROR, "Consumed more bytes than we got! (%d)\n", src_len); - } while (src_len > 2); // because there could be rtp padding.. + } if(pass==0) { // now we know the total size of the packet (with the start sequences added) -- cgit v1.2.3