diff options
| author | Martin Storsjö <martin@martin.st> | 2012-12-11 18:58:59 +0200 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2012-12-12 12:18:16 +0200 |
| commit | 81ef5192529dd9ff6b7dc34b6528b9d8dafdd100 (patch) | |
| tree | 8832ec4cbb5031674e34235bdce71dbc74ef6c60 | |
| parent | 48238fd00b22518158999a0aac5d620bc31dc8d7 (diff) | |
| download | ffmpeg-81ef5192529dd9ff6b7dc34b6528b9d8dafdd100.tar.gz | |
rtpdec: Limit writing to the buffer size
This fixes potential buffer overwrites.
Signed-off-by: Martin Storsjö <martin@martin.st>
| -rw-r--r-- | libavformat/rtpdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c index 3b03bdaa14..b83a79bdbb 100644 --- a/libavformat/rtpdec.c +++ b/libavformat/rtpdec.c @@ -531,7 +531,7 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt, if (ret < 0) return AVERROR(EAGAIN); if (ret < len) { - s->read_buf_size = len - ret; + s->read_buf_size = FFMIN(len - ret, sizeof(s->buf)); memcpy(s->buf, buf + ret, s->read_buf_size); s->read_buf_index = 0; return 1; |