diff options
| author | Martin Storsjö <martin@martin.st> | 2010-03-11 16:26:14 +0000 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2010-03-11 16:26:14 +0000 |
| commit | 34056cbba55f0131e8d2698717ab9e86e2da5178 (patch) | |
| tree | 4233eb261993a049777a7439a94aed443ff02711 /libavformat | |
| parent | 70b462cc2940bce1023adb0780a83725526117f4 (diff) | |
| download | ffmpeg-34056cbba55f0131e8d2698717ab9e86e2da5178.tar.gz | |
Fix a crash in the H.263 RTP packetizer
If size == 1 and buf[0] == 0 and buf[1] == 0 (the first byte after the
buffer), it would set size = -1 and crash in the later memcpy.
Originally committed as revision 22469 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpenc_h263.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpenc_h263.c b/libavformat/rtpenc_h263.c index 0ea492106b..84403a1069 100644 --- a/libavformat/rtpenc_h263.c +++ b/libavformat/rtpenc_h263.c @@ -50,7 +50,7 @@ void ff_rtp_send_h263(AVFormatContext *s1, const uint8_t *buf1, int size) while (size > 0) { q = s->buf; - if ((buf1[0] == 0) && (buf1[1] == 0)) { + if (size >= 2 && (buf1[0] == 0) && (buf1[1] == 0)) { *q++ = 0x04; buf1 += 2; size -= 2; |