Commit f928f7db authored by Rafaël Carré's avatar Rafaël Carré

Really fix H264 packetizing: abort PacketizeAVC1() if computed size is too huge

(cherry picked from commit 96fca586)
parent ba61d7b9
......@@ -443,22 +443,23 @@ static block_t *PacketizeAVC1( decoder_t *p_dec, block_t **pp_block )
i_size = (i_size << 8) | (*p++);
}
if( i_size > 0 && i_size < p_block->i_buffer )
if( i_size <= 0 ||
i_size >= ( p - p_block->p_buffer + p_block->i_buffer ) )
{
block_t *p_part = nal_get_annexeb( p_dec, p, i_size );
if( !p_part )
{
block_Release( p_block );
return NULL;
}
p_part->i_dts = p_block->i_dts;
p_part->i_pts = p_block->i_pts;
msg_Err( p_dec, "Broken frame : size %d is too big", i_size );
break;
}
/* Parse the NAL */
if( ( p_pic = ParseNALBlock( p_dec, p_part ) ) )
{
block_ChainAppend( &p_ret, p_pic );
}
block_t *p_part = nal_get_annexeb( p_dec, p, i_size );
if( !p_part )
break;
p_part->i_dts = p_block->i_dts;
p_part->i_pts = p_block->i_pts;
/* Parse the NAL */
if( ( p_pic = ParseNALBlock( p_dec, p_part ) ) )
{
block_ChainAppend( &p_ret, p_pic );
}
p += i_size;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment