generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/rtpdec_h264: fix null pointer dereferences

Browse Source 
Fixes CID733716

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-13 01:27:26 +01:00
parent db8a53d86a
commit c5f15f40b9
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/rtpdec_h264.c
View File

@ -190,7 +190,8 @@ static int h264_handle_packet(AVFormatContext *ctx, PayloadContext *data,
switch (type) { switch (type) {
case 0: // undefined, but pass them through case 0: // undefined, but pass them through
case 1: case 1:
av_new_packet(pkt, len + sizeof(start_sequence)); if ((result = av_new_packet(pkt, len + sizeof(start_sequence))) < 0)
return result;
memcpy(pkt->data, start_sequence, sizeof(start_sequence)); memcpy(pkt->data, start_sequence, sizeof(start_sequence));
memcpy(pkt->data + sizeof(start_sequence), buf, len); memcpy(pkt->data + sizeof(start_sequence), buf, len);
COUNT_NAL_TYPE(data, nal); COUNT_NAL_TYPE(data, nal);
@ -292,12 +293,14 @@ static int h264_handle_packet(AVFormatContext *ctx, PayloadContext *data,
COUNT_NAL_TYPE(data, nal_type); COUNT_NAL_TYPE(data, nal_type);
if (start_bit) { if (start_bit) {
/* copy in the start sequence, and the reconstructed nal */ /* copy in the start sequence, and the reconstructed nal */
av_new_packet(pkt, sizeof(start_sequence) + sizeof(nal) + len); if ((result = av_new_packet(pkt, sizeof(start_sequence) + sizeof(nal) + len)) < 0)
return result;
memcpy(pkt->data, start_sequence, sizeof(start_sequence)); memcpy(pkt->data, start_sequence, sizeof(start_sequence));
pkt->data[sizeof(start_sequence)] = reconstructed_nal; pkt->data[sizeof(start_sequence)] = reconstructed_nal;
memcpy(pkt->data + sizeof(start_sequence) + sizeof(nal), buf, len); memcpy(pkt->data + sizeof(start_sequence) + sizeof(nal), buf, len);
} else { } else {
av_new_packet(pkt, len); if ((result = av_new_packet(pkt, len)) < 0)
return result;
memcpy(pkt->data, buf, len); memcpy(pkt->data, buf, len);
} }
} else { } else {