diff options
author | Jacob Siddall <kobe@live.com.au> | 2019-06-27 09:06:22 +0300 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-05 19:08:08 +0300 |
commit | 9051092e73666e95986eb2d596cc0867aea05c3d (patch) | |
tree | aac1bf9506f9ec31ca2e67f28d7bdc2d6502d2ed /libavformat/rtpdec_rfc4175.c | |
parent | f12e662a3d3f489eec887b5f2ab20a550caed9cf (diff) |
avformat/rtpdec_rfc4175: Fix incorrect copy_offset calculation
The previous calculation code did not account for the fact that the
copy_offset for the start of the frame array is at index 0, yet the
scan line number from the rfc4175 RTP header starts at 1.
This caused 2 issues to appear:
- The first scan line was being copied into the array where the second
scan line should be. This caused the resulting video to have a green
line at the top of it.
- Since the packet containing the last scan line would fail the
calculation, the packet with the RTP marker would not be processed
which caused a log message saying "Missed previous RTP marker" to be
outputted for each frame.
Signed-off-by: Jacob Siddall <kobe@live.com.au>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/rtpdec_rfc4175.c')
-rw-r--r-- | libavformat/rtpdec_rfc4175.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index e9c62c1389..490db87520 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -205,8 +205,11 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data, if (length > payload_len) length = payload_len; + if (line < 1) + return AVERROR_INVALIDDATA; + /* prevent ill-formed packets to write after buffer's end */ - copy_offset = (line * data->width + offset) * data->pgroup / data->xinc; + copy_offset = ((line - 1) * data->width + offset) * data->pgroup / data->xinc; if (copy_offset + length > data->frame_size) return AVERROR_INVALIDDATA; |