From 5d6ecf5345c0913e2b66427ea062e7989201a139 Mon Sep 17 00:00:00 2001
From: John Brooks <john.brooks@bluecherry.net>
Date: Wed, 12 Oct 2011 11:06:26 +0300
Subject: rtpdec: Fix the minimum packet length for RTCP SR packets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We actually read 20 bytes of these packets.

Signed-off-by: Martin Storsjö <martin@martin.st>
---
 libavformat/rtpdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavformat')

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index 37122600a5..07f4cc35c5 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -115,7 +115,7 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int l
     while (len >= 2) {
         switch (buf[1]) {
         case RTCP_SR:
-            if (len < 16) {
+            if (len < 20) {
                 av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n");
                 return AVERROR_INVALIDDATA;
             }
-- 
cgit v1.2.3