[FFmpeg-cvslog] rtpdec_h264: Add input size checks

[Ivan Kovtunov]

ffmpeg | branch: master | Ivan Kovtunov <belevern at gmail.com> | Fri May  4 22:31:46 2012 +0300| [de26a4b6993ff3dc91f17d110326736c96bfc9ec] | committer: Martin Storsjö

rtpdec_h264: Add input size checks

This fixes crashes if given too short data packets.

Signed-off-by: Martin Storsjö <martin at martin.st>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=de26a4b6993ff3dc91f17d110326736c96bfc9ec
---

 libavformat/rtpdec_h264.c |   16 +++++++++++++---
 1 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/libavformat/rtpdec_h264.c b/libavformat/rtpdec_h264.c
index 32a57d3..51447f9 100644
--- a/libavformat/rtpdec_h264.c
+++ b/libavformat/rtpdec_h264.c
@@ -173,11 +173,18 @@ static int h264_handle_packet(AVFormatContext *ctx,
                               const uint8_t * buf,
                               int len, int flags)
 {
-    uint8_t nal = buf[0];
-    uint8_t type = (nal & 0x1f);
+    uint8_t nal;
+    uint8_t type;
     int result= 0;
     uint8_t start_sequence[] = { 0, 0, 0, 1 };
 
+    if (!len) {
+        av_log(ctx, AV_LOG_ERROR, "Empty H264 RTP packet\n");
+        return AVERROR_INVALIDDATA;
+    }
+    nal  = buf[0];
+    type = nal & 0x1f;
+
 #ifdef DEBUG
     assert(data);
     assert(data->cookie == MAGIC_COOKIE);
@@ -271,7 +278,7 @@ static int h264_handle_packet(AVFormatContext *ctx,
     case 28:                   // FU-A (fragmented nal)
         buf++;
         len--;                  // skip the fu_indicator
-        {
+        if (len > 1) {
             // these are the same as above, we just redo them here for clarity...
             uint8_t fu_indicator = nal;
             uint8_t fu_header = *buf;   // read the fu_header.
@@ -302,6 +309,9 @@ static int h264_handle_packet(AVFormatContext *ctx,
                 av_new_packet(pkt, len);
                 memcpy(pkt->data, buf, len);
             }
+        } else {
+            av_log(ctx, AV_LOG_ERROR, "Too short data for FU-A H264 RTP packet\n");
+            result = AVERROR_INVALIDDATA;
         }
         break;