har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/rtpenc_jpeg: Check remaining buffer size for SOS

Browse Source 
Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-05-12 17:55:40 +02:00
parent c3671e1d57
commit 81198a6837
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/rtpenc_jpeg.c
View File

@ -84,6 +84,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
} else if (buf[i + 1] == SOS) { } else if (buf[i + 1] == SOS) {
/* SOS is last marker in the header */ /* SOS is last marker in the header */
i += AV_RB16(&buf[i + 2]) + 2; i += AV_RB16(&buf[i + 2]) + 2;
if (i > size) {
av_log(s1, AV_LOG_ERROR,
"Insufficient data. Aborted!\n");
return;
}
break; break;
} }
} }