Mercurial > libavformat.hg

diff rtpenc_h263.c @ 5822:528440939c06 libavformat

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix a crash in the H.263 RTP packetizer If size == 1 and buf[0] == 0 and buf[1] == 0 (the first byte after the buffer), it would set size = -1 and crash in the later memcpy.
author mstorsjo
date Thu, 11 Mar 2010 16:26:14 +0000
parents e09092917f7e
children
line wrap: on
line diff
--- a/rtpenc_h263.c	Thu Mar 11 12:29:02 2010 +0000
+++ b/rtpenc_h263.c	Thu Mar 11 16:26:14 2010 +0000
@@ -50,7 +50,7 @@
 
     while (size > 0) {
         q = s->buf;
-        if ((buf1[0] == 0) && (buf1[1] == 0)) {
+        if (size >= 2 && (buf1[0] == 0) && (buf1[1] == 0)) {
             *q++ = 0x04;
             buf1 += 2;
             size -= 2;