H264 packetizer : NEVER TRUST INPUT !!
authorRafaël Carré <funman@videolan.org>
Fri, 28 Mar 2008 15:51:16 +0000 (16:51 +0100)
committerJean-Paul Saman <jpsaman@videolan.org>
Mon, 31 Mar 2008 07:36:00 +0000 (09:36 +0200)
Do not allocate ridiculous amount of datas.

Signed-off-by: Jean-Paul Saman <jpsaman@videolan.org>
modules/packetizer/h264.c

index 04336a7..dac5ece 100644 (file)
@@ -447,10 +447,14 @@ static block_t *PacketizeAVC1( decoder_t *p_dec, block_t **pp_block )
             i_size = (i_size << 8) | (*p++);
         }
 
-        if( i_size > 0 )
+        if( i_size > 0 && i_size < p_block->i_buffer )
         {
             block_t *p_part = nal_get_annexeb( p_dec, p, i_size );
-
+            if( !p_part )
+            {
+                block_Release( p_block );
+                return NULL;
+            }
             p_part->i_dts = p_block->i_dts;
             p_part->i_pts = p_block->i_pts;
 
@@ -472,6 +476,7 @@ static block_t *nal_get_annexeb( decoder_t *p_dec, uint8_t *p, int i_size )
     block_t *p_nal;
 
     p_nal = block_New( p_dec, 4 + i_size );
+    if( !p_nal ) return NULL;
 
     /* Add start code */
     p_nal->p_buffer[0] = 0x00;