aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-05-12 17:55:40 +0200
committerMichael Niedermayer <michaelni@gmx.at>2015-06-10 02:13:11 +0200
commitb470e21d61558be80c40dd47bfae85e7fe4a99e5 (patch)
tree823c08b64c1b151881f51113af00271e40fffdf1
parent4a9ce87ef334e4ae2f21bfa9dc392e7203d2316a (diff)
downloadffmpeg-b470e21d61558be80c40dd47bfae85e7fe4a99e5.tar.gz
avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/rtpenc_jpeg.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c
index 7eb0e23c6f..47898a30ad 100644
--- a/libavformat/rtpenc_jpeg.c
+++ b/libavformat/rtpenc_jpeg.c
@@ -80,6 +80,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
} else if (buf[i + 1] == SOS) {
/* SOS is last marker in the header */
i += AV_RB16(&buf[i + 2]) + 2;
+ if (i > size) {
+ av_log(s1, AV_LOG_ERROR,
+ "Insufficient data. Aborted!\n");
+ return;
+ }
break;
}
}