rtp: fix static array overruns

Yes array[10] has elements from 0...9.

diff --git a/gst/rtp/gstrtpjpegpay.c b/gst/rtp/gstrtpjpegpay.c
index fc4096d..9a34447 100644 (file)
--- a/gst/rtp/gstrtpjpegpay.c
+++ b/gst/rtp/gstrtpjpegpay.c
@@ -716,7 +716,7 @@ gst_rtp_jpeg_pay_handle_buffer (GstBaseRTPPayload * basepayload,
       guint qt;
 
       qt = info[i].qt;
-      if (qt > 15)
+      if (qt > 14)
         goto invalid_quant;
 
       qsize = tables[qt].size;

diff --git a/gst/rtp/gstrtpmp4adepay.c b/gst/rtp/gstrtpmp4adepay.c
index 18ebfd2..edcd8db 100644 (file)
--- a/gst/rtp/gstrtpmp4adepay.c
+++ b/gst/rtp/gstrtpmp4adepay.c
@@ -229,7 +229,7 @@ gst_rtp_mp4a_depay_setcaps (GstBaseRTPDepayload * depayload, GstCaps * caps)
 
       if (!gst_bit_reader_get_bits_uint8 (&br, &sr_idx, 4))
         goto bad_config;
-      if (sr_idx > 12 && sr_idx != 15) {
+      if (sr_idx > 11 && sr_idx != 15) {
         GST_WARNING_OBJECT (depayload, "invalid sample rate index %d", sr_idx);
         goto bad_config;
       }

diff --git a/gst/rtp/gstrtpqcelpdepay.c b/gst/rtp/gstrtpqcelpdepay.c
index 7949ae7..e83ed2c 100644 (file)
--- a/gst/rtp/gstrtpqcelpdepay.c
+++ b/gst/rtp/gstrtpqcelpdepay.c
@@ -164,7 +164,7 @@ static const gint frame_size[16] = {
 static gint
 get_frame_len (GstRtpQCELPDepay * depay, guint8 frame_type)
 {
-  if (frame_type > 16)
+  if (frame_type > 15)
     return 0;
 
   return frame_size[frame_type];