PR #24625 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24625 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24625.patch
Found-by: zhang xingxing <[email protected]> Suggested-by: zhang xingxing <[email protected]> Fixes: negative bit count passed to get_bits() Fixes: TpkkPldjeLLt >From 001dc33e553f7ec25c706fd3a11fba8855140c23 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 22 Sep 2026 00:30:21 +0200 Subject: [PATCH] avformat/rtpdec_h261: check that the payload holds the bits to be merged Found-by: zhang xingxing <[email protected]> Suggested-by: zhang xingxing <[email protected]> Fixes: negative bit count passed to get_bits() Fixes: TpkkPldjeLLt --- libavformat/rtpdec_h261.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c index 57bc10fb3d..1fb71f2b10 100644 --- a/libavformat/rtpdec_h261.c +++ b/libavformat/rtpdec_h261.c @@ -122,6 +122,8 @@ static int h261_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_h261_ctx res = init_get_bits(&gb, buf, len*8 - ebit); if (res < 0) return res; + if (get_bits_left(&gb) < sbit + (rtp_h261_ctx->endbyte_bits ? 8 - rtp_h261_ctx->endbyte_bits : 0)) + return AVERROR_INVALIDDATA; skip_bits(&gb, sbit); if (rtp_h261_ctx->endbyte_bits) { rtp_h261_ctx->endbyte |= get_bits(&gb, 8 - rtp_h261_ctx->endbyte_bits); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
