diff options
| author | Olivier Crete <tester@tester.ca> | 2008-03-08 04:21:34 +0000 |
|---|---|---|
| committer | Sebastian Dröge <slomo@circular-chaos.org> | 2008-03-08 04:21:34 +0000 |
| commit | c7296fe79a7e2f05d33f9ad5cb5b136150a1f710 (patch) | |
| tree | cab5969f05ae849785be98844248edbf57af0db7 /gst/rtp/gstrtph263pdepay.c | |
| parent | 41e9c150f6071071a0d97306956836238e76cbf7 (diff) | |
gst/rtp/gstrtph263pdepay.c: Check that a buffer is large enough before reading from it.
Original commit message from CVS:
Patch by: Olivier Crete <tester at tester dot ca>
* gst/rtp/gstrtph263pdepay.c: (gst_rtp_h263p_depay_process):
Check that a buffer is large enough before reading from it.
Fixes bug #521102.
Diffstat (limited to 'gst/rtp/gstrtph263pdepay.c')
| -rw-r--r-- | gst/rtp/gstrtph263pdepay.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/gst/rtp/gstrtph263pdepay.c b/gst/rtp/gstrtph263pdepay.c index 082d26f6..7d775732 100644 --- a/gst/rtp/gstrtph263pdepay.c +++ b/gst/rtp/gstrtph263pdepay.c @@ -265,6 +265,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) header_len = 2; + if (payload_len < header_len) + goto bad_packet; + M = gst_rtp_buffer_get_marker (buf); /* 0 1 @@ -285,6 +288,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) header_len += PLEN; } + if ((!P && payload_len < header_len) || (P && payload_len < header_len - 2)) + goto bad_packet; + if (P) { rtph263pdepay->wait_start = FALSE; header_len -= 2; |