Really fix H264 packetizing: abort PacketizeAVC1() if computed size is too huge

modules/packetizer/h264.c

@@ -447,14 +447,16 @@ static block_t *PacketizeAVC1( decoder_t *p_dec, block_t **pp_block )
             i_size = (i_size << 8) | (*p++);
         }
 
-        if( i_size > 0 && i_size < p_block->i_buffer )
+        if( i_size <= 0 ||
+            i_size >= ( p - p_block->p_buffer + p_block->i_buffer ) )
         {
+            msg_Err( p_dec, "Broken frame : size %d is too big", i_size );
+            break;
+        }
+
         block_t *p_part = nal_get_annexeb( p_dec, p, i_size );
         if( !p_part )
-            {
-                block_Release( p_block );
-                return NULL;
-            }
+            break;
         p_part->i_dts = p_block->i_dts;
         p_part->i_pts = p_block->i_pts;
 
@@ -463,7 +465,6 @@ static block_t *PacketizeAVC1( decoder_t *p_dec, block_t **pp_block )
         {
             block_ChainAppend( &p_ret, p_pic );
         }
-        }
         p += i_size;
     }
     block_Release( p_block );