On 12/11/12 9:06 PM, Martin Storsjö wrote:
This fixes potential buffer overwrites. --- libavformat/rtpdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c index 3b03bda..b83a79b 100644 --- a/libavformat/rtpdec.c +++ b/libavformat/rtpdec.c @@ -531,7 +531,7 @@ static int rtp_parse_packet_internal(RTPDemuxContext *s, AVPacket *pkt, if (ret < 0) return AVERROR(EAGAIN); if (ret < len) { - s->read_buf_size = len - ret; + s->read_buf_size = FFMIN(len - ret, sizeof(s->buf)); memcpy(s->buf, buf + ret, s->read_buf_size); s->read_buf_index = 0; return 1;
ok _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
