| Index: webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
|
| diff --git a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
|
| index 64a2a94b7eb8078328c343277b12b653cdf19749..24ebe769de08f2f7580dc4aaff5c7e830b765fcc 100644
|
| --- a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
|
| +++ b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
|
| @@ -403,6 +403,11 @@ bool RtpDepacketizerH264::ProcessStapAOrSingleNalu(
|
| // End offset is actually start offset for next unit, excluding length field
|
| // so remove that from this units length.
|
| size_t end_offset = nalu_start_offsets[i + 1] - kLengthFieldSize;
|
| + if (end_offset - start_offset < H264::kNaluTypeSize) {
|
| + LOG(LS_ERROR) << "STAP-A packet too short";
|
| + return false;
|
| + }
|
| +
|
| nal_type = payload_data[start_offset] & kTypeMask;
|
| start_offset += H264::kNaluTypeSize;
|
|
|
|
|