diff options
| author | ThomasVolkert <thomas@homer-conferencing.com> | 2014-08-26 14:23:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-26 20:37:58 +0200 |
| commit | e15824e75b5549e53eb5c1ffb79766321ac8d122 (patch) | |
| tree | 5efdccb1d2f2c21071ab468e3498a574b41dbef0 | |
| parent | 604c4eab2bf633ad4583cbb7b0efb5d1f010c8ee (diff) | |
| download | ffmpeg-e15824e75b5549e53eb5c1ffb79766321ac8d122.tar.gz | |
avformat/rtpdec_h261: Fix sanity checks
Fixes mbap and quant
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/rtpdec_h261.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c index c1d79a8ace..b902d2aa40 100644 --- a/libavformat/rtpdec_h261.c +++ b/libavformat/rtpdec_h261.c @@ -117,8 +117,8 @@ int ff_h261_handle_packet(AVFormatContext *ctx, PayloadContext *data, sbit = (buf[0] >> 5) & 0x07; ebit = (buf[0] >> 2) & 0x07; gobn = (buf[1] >> 4) & 0x0f; - mbap = ((buf[1] << 1) & 0x1e) | ((buf[1] >> 7) & 0x01); - quant = (buf[1] >> 4) & 0x0f; + mbap = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01); + quant = (buf[2] >> 2) & 0x1f; /* pass the H.261 payload header and continue with the actual payload */ buf += RTP_H261_PAYLOAD_HEADER_SIZE; |