On Sat, Mar 26, 2016 at 10:38 AM, Carl Eugen Hoyos <ceho...@ag.or.at> wrote:
> index 2d447f7..170db31 100644
> --- a/libavcodec/h264_mp4toannexb_bsf.c
> +++ b/libavcodec/h264_mp4toannexb_bsf.c
> @@ -167,7 +167,8 @@ static int
> h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
> int ret = 0;
>
> /* nothing to filter */
> - if (!avctx->extradata || avctx->extradata_size < 6) {
> + if ( !avctx->extradata || avctx->extradata_size < 6
> + || !buf[0] && !buf[1] && (buf[2] == 1 || !buf[2] && buf[3] == 1)) {
> *poutbuf = (uint8_t *)buf;
> *poutbuf_size = buf_size;
> return 0;
A 4-byte mp4 style size code could conceivably start with 0x000001xx
(ie. a size from 256 bytes to 511 bytes), this seems very risky.
- Hendrik
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
