diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 17:55:40 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-01 23:25:20 +0200 |
| commit | fbd9ab5967f6163d6e31c40934f86164b7b0f88c (patch) | |
| tree | af83726c91f6700bf89075563a2c199ec4cfc2da /libavformat | |
| parent | 18e83992f20e31d71b0bf87f2deb4e95e3abc333 (diff) | |
| download | ffmpeg-fbd9ab5967f6163d6e31c40934f86164b7b0f88c.tar.gz | |
avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpenc_jpeg.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c index c4f7b5e7d2..be7ba6190f 100644 --- a/libavformat/rtpenc_jpeg.c +++ b/libavformat/rtpenc_jpeg.c @@ -84,6 +84,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) } else if (buf[i + 1] == SOS) { /* SOS is last marker in the header */ i += AV_RB16(&buf[i + 2]) + 2; + if (i > size) { + av_log(s1, AV_LOG_ERROR, + "Insufficient data. Aborted!\n"); + return; + } break; } } |