MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix a crash in the H.263 RTP packetizer

Browse Source 
If size == 1 and buf[0] == 0 and buf[1] == 0 (the first byte after the
buffer), it would set size = -1 and crash in the later memcpy.

Originally committed as revision 22469 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Martin Storsjö 2010-03-11 16:26:14 +00:00
parent 70b462cc29
commit 34056cbba5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/rtpenc_h263.c
View File

@ -50,7 +50,7 @@ void ff_rtp_send_h263(AVFormatContext *s1, const uint8_t *buf1, int size)
while (size > 0) {
q = s->buf;
if ((buf1[0] == 0) && (buf1[1] == 0)) {
if (size >= 2 && (buf1[0] == 0) && (buf1[1] == 0)) {
*q++ = 0x04;
buf1 += 2;
size -= 2;