diff options
| author | Martin Storsjö | 2012-05-04 22:45:11 +0300 |
|---|---|---|
| committer | Martin Storsjö | 2012-05-05 03:09:10 +0300 |
| commit | 5245adb963e35660a70115c437cd67ea0c398885 (patch) | |
| tree | bd80425fc6866e398e6615f687f25f413c311ec6 /libavformat | |
| parent | de26a4b6993ff3dc91f17d110326736c96bfc9ec (diff) | |
rtpdec_h264: Check the available data length before reading
This makes sure the length is checked for STAP-A type packets.
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpdec_h264.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/rtpdec_h264.c b/libavformat/rtpdec_h264.c index 51447f9703..8b56ada397 100644 --- a/libavformat/rtpdec_h264.c +++ b/libavformat/rtpdec_h264.c @@ -218,7 +218,7 @@ static int h264_handle_packet(AVFormatContext *ctx, const uint8_t *src= buf; int src_len= len; - do { + while (src_len > 2) { uint16_t nal_size = AV_RB16(src); // this going to be a problem if unaligned (can it be?) // consume the length of the aggregate... @@ -252,7 +252,7 @@ static int h264_handle_packet(AVFormatContext *ctx, if (src_len < 0) av_log(ctx, AV_LOG_ERROR, "Consumed more bytes than we got! (%d)\n", src_len); - } while (src_len > 2); // because there could be rtp padding.. + } if(pass==0) { // now we know the total size of the packet (with the start sequences added) |