Index: webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc |
diff --git a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc |
index 64a2a94b7eb8078328c343277b12b653cdf19749..24ebe769de08f2f7580dc4aaff5c7e830b765fcc 100644 |
--- a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc |
+++ b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc |
@@ -403,6 +403,11 @@ bool RtpDepacketizerH264::ProcessStapAOrSingleNalu( |
// End offset is actually start offset for next unit, excluding length field |
// so remove that from this units length. |
size_t end_offset = nalu_start_offsets[i + 1] - kLengthFieldSize; |
+ if (end_offset - start_offset < H264::kNaluTypeSize) { |
+ LOG(LS_ERROR) << "STAP-A packet too short"; |
+ return false; |
+ } |
+ |
nal_type = payload_data[start_offset] & kTypeMask; |
start_offset += H264::kNaluTypeSize; |