[FFmpeg-cvslog] avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Michael Niedermayer
git at videolan.org
Tue Jun 2 00:50:07 CEST 2015
ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni at gmx.at> | Tue May 12 17:55:40 2015 +0200| [fbd9ab5967f6163d6e31c40934f86164b7b0f88c] | committer: Michael Niedermayer
avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fbd9ab5967f6163d6e31c40934f86164b7b0f88c
---
libavformat/rtpenc_jpeg.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c
index c4f7b5e..be7ba61 100644
--- a/libavformat/rtpenc_jpeg.c
+++ b/libavformat/rtpenc_jpeg.c
@@ -84,6 +84,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
} else if (buf[i + 1] == SOS) {
/* SOS is last marker in the header */
i += AV_RB16(&buf[i + 2]) + 2;
+ if (i > size) {
+ av_log(s1, AV_LOG_ERROR,
+ "Insufficient data. Aborted!\n");
+ return;
+ }
break;
}
}
More information about the ffmpeg-cvslog
mailing list