[FFmpeg-devel] [PATCH] ituh263dec: Prevent overreading header buffer

[Derek Buitenhuis]

Signed-off-by: Derek Buitenhuis <derek.buitenhuis at gmail.com>
---
Fixes a crash in a sample I have.
---
 libavcodec/ituh263dec.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c
index 08aeb30..6c7c12d 100644
--- a/libavcodec/ituh263dec.c
+++ b/libavcodec/ituh263dec.c
@@ -874,6 +874,11 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
 
     align_get_bits(&s->gb);
 
+    if (get_bits_left(&s->gb) < 22 - 8) {
+        av_log(s->avctx, AV_LOG_ERROR, "Not enough bits to decode header.\n");
+        return -1;
+    }
+
     if (show_bits(&s->gb, 2) == 2 && s->avctx->frame_number == 0) {
          av_log(s->avctx, AV_LOG_WARNING, "Header looks like RTP instead of H.263\n");
     }
-- 
1.7.1