[FFmpeg-devel] [PATCH v2 1/3] lavf/rtpdec: fix RTCP SR packet length check

[Marvin Scholz]

On 28 Jun 2025, at 16:27, Marvin Scholz wrote:

> The minimum valid packet length is 28, given that the length includes
> the packet header.
>
> This didn't cause any issues so far as the code did not care about the
> last two fields in the SR section, but will be relevant in a future
> commit.
> ---
>  libavformat/rtpdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
> index d54ac31eb0..5aecf7fbc7 100644
> --- a/libavformat/rtpdec.c
> +++ b/libavformat/rtpdec.c
> @@ -187,7 +187,7 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf,
>
>          switch (buf[1]) {
>          case RTCP_SR:
> -            if (payload_len < 20) {
> +            if (payload_len < 28) {
>                  av_log(s->ic, AV_LOG_ERROR, "Invalid RTCP SR packet length\n");
>                  return AVERROR_INVALIDDATA;
>              }
> -- 
> 2.39.5 (Apple Git-154)

If there are no objections, I plan to push this patchset start of next week.