diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:07:32 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:07:32 +0200 |
| commit | a23379a0a68a6dd9a0e0d583e11b0c6f9b33f9ae (patch) | |
| tree | e33e133afbc651329e3ded599c10b7453b50f577 /libavformat/rtpdec_xiph.c | |
| parent | aa5169935e160551fb1c290d1397da2f04325817 (diff) | |
| download | ffmpeg-a23379a0a68a6dd9a0e0d583e11b0c6f9b33f9ae.tar.gz | |
avformat/rtpdec_xiph: Move pkt_len onto one side of the check
This is more correct
Fixes CID1271793
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/rtpdec_xiph.c')
| -rw-r--r-- | libavformat/rtpdec_xiph.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec_xiph.c b/libavformat/rtpdec_xiph.c index 8492865b4f..eceb840580 100644 --- a/libavformat/rtpdec_xiph.c +++ b/libavformat/rtpdec_xiph.c @@ -73,7 +73,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, } pkt_len = AV_RB16(data->split_buf + data->split_pos); data->split_pos += 2; - if (data->split_pos + pkt_len > data->split_buf_len) { + if (pkt_len > data->split_buf_len - data->split_pos) { av_log(ctx, AV_LOG_ERROR, "Not enough data to return\n"); return AVERROR_INVALIDDATA; } |