h264: Fix a possible overread in decode_nal_units()
authorAlexander Strange <astrange@ithinksw.com>
Mon, 12 Dec 2011 23:13:39 +0000 (18:13 -0500)
committerAnton Khirnov <anton@khirnov.net>
Fri, 23 Dec 2011 07:32:18 +0000 (08:32 +0100)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
libavcodec/h264.c

index a9a1051..2bde0fe 100644 (file)
@@ -3764,7 +3764,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         int err;
 
         if(buf_index >= next_avc) {
-            if(buf_index >= buf_size) break;
+            if (buf_index >= buf_size - h->nal_length_size) break;
             nalsize = 0;
             for(i = 0; i < h->nal_length_size; i++)
                 nalsize = (nalsize << 8) | buf[buf_index++];