Commit c5f15f40 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/rtpdec_h264: fix null pointer dereferences

Fixes CID733716
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent db8a53d8
......@@ -190,7 +190,8 @@ static int h264_handle_packet(AVFormatContext *ctx, PayloadContext *data,
switch (type) {
case 0: // undefined, but pass them through
case 1:
av_new_packet(pkt, len + sizeof(start_sequence));
if ((result = av_new_packet(pkt, len + sizeof(start_sequence))) < 0)
return result;
memcpy(pkt->data, start_sequence, sizeof(start_sequence));
memcpy(pkt->data + sizeof(start_sequence), buf, len);
COUNT_NAL_TYPE(data, nal);
......@@ -292,12 +293,14 @@ static int h264_handle_packet(AVFormatContext *ctx, PayloadContext *data,
COUNT_NAL_TYPE(data, nal_type);
if (start_bit) {
/* copy in the start sequence, and the reconstructed nal */
av_new_packet(pkt, sizeof(start_sequence) + sizeof(nal) + len);
if ((result = av_new_packet(pkt, sizeof(start_sequence) + sizeof(nal) + len)) < 0)
return result;
memcpy(pkt->data, start_sequence, sizeof(start_sequence));
pkt->data[sizeof(start_sequence)] = reconstructed_nal;
memcpy(pkt->data + sizeof(start_sequence) + sizeof(nal), buf, len);
} else {
av_new_packet(pkt, len);
if ((result = av_new_packet(pkt, len)) < 0)
return result;
memcpy(pkt->data, buf, len);
}
} else {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment