aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorXi Wang <xi.wang@gmail.com>2013-01-22 20:58:07 -0500
committerMartin Storsjö <martin@martin.st>2013-01-23 13:51:29 +0200
commitcf29f49d8ae00bb153c24b5c8a8f6cb150a91de8 (patch)
tree8aa856c0dee1acd12df604bfb49792405bec66f9 /libavformat
parentecb918e5f0a4395468862b5fbd11a51de9be3d4f (diff)
downloadffmpeg-cf29f49d8ae00bb153c24b5c8a8f6cb150a91de8.tar.gz
rtpenc: fix overflow checking in avc_mp4_find_startcode()
The check `start + res < start' is broken since pointer overflow is undefined behavior in C. Many compilers such as gcc/clang optimize away this check. Use `res > end - start' instead. Also change `res' to unsigned int to avoid signed left-shift overflow. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/rtpenc_h264.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/rtpenc_h264.c b/libavformat/rtpenc_h264.c
index ac74074307..206d9bafa3 100644
--- a/libavformat/rtpenc_h264.c
+++ b/libavformat/rtpenc_h264.c
@@ -31,14 +31,14 @@
static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t *end, int nal_length_size)
{
- int res = 0;
+ unsigned int res = 0;
if (end - start < nal_length_size)
return NULL;
while (nal_length_size--)
res = (res << 8) | *start++;
- if (start + res > end || res < 0 || start + res < start)
+ if (res > end - start)
return NULL;
return start + res;