Commit c7296fe7 authored by Olivier Crete's avatar Olivier Crete Committed by Sebastian Dröge
Browse files

gst/rtp/gstrtph263pdepay.c: Check that a buffer is large enough before reading from it.

Original commit message from CVS:
Patch by: Olivier Crete <tester at tester dot ca>
* gst/rtp/gstrtph263pdepay.c: (gst_rtp_h263p_depay_process):
Check that a buffer is large enough before reading from it.
Fixes bug #521102.
parent 41e9c150
2008-03-08 Sebastian Dröge <slomo@circular-chaos.org>
Patch by: Olivier Crete <tester at tester dot ca>
* gst/rtp/gstrtph263pdepay.c: (gst_rtp_h263p_depay_process):
Check that a buffer is large enough before reading from it.
Fixes bug #521102.
2008-03-07 Wim Taymans <wim.taymans@collabora.co.uk> 2008-03-07 Wim Taymans <wim.taymans@collabora.co.uk>
   
* gst/udp/gstudpsrc.c: (gst_udpsrc_start): * gst/udp/gstudpsrc.c: (gst_udpsrc_start):
......
common @ 170f8e91
Subproject commit e02bd43fe6b9e45536eccbf5b7a5f9eae62030fd Subproject commit 170f8e91adc7157f6e708ffa58ca22d10e4e45da
...@@ -265,6 +265,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) ...@@ -265,6 +265,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
header_len = 2; header_len = 2;
if (payload_len < header_len)
goto bad_packet;
M = gst_rtp_buffer_get_marker (buf); M = gst_rtp_buffer_get_marker (buf);
/* 0 1 /* 0 1
...@@ -285,6 +288,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf) ...@@ -285,6 +288,9 @@ gst_rtp_h263p_depay_process (GstBaseRTPDepayload * depayload, GstBuffer * buf)
header_len += PLEN; header_len += PLEN;
} }
if ((!P && payload_len < header_len) || (P && payload_len < header_len - 2))
goto bad_packet;
if (P) { if (P) {
rtph263pdepay->wait_start = FALSE; rtph263pdepay->wait_start = FALSE;
header_len -= 2; header_len -= 2;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment