p += 6;
for (i = 0; i < cnt; i++) {
nalsize = AV_RB16(p) + 2;
+ if (p - avctx->extradata + nalsize > avctx->extradata_size)
+ return -1;
if(decode_nal_units(h, p, nalsize) < 0) {
av_log(avctx, AV_LOG_ERROR, "Decoding sps %d from avcC failed\n", i);
return -1;
cnt = *(p++); // Number of pps
for (i = 0; i < cnt; i++) {
nalsize = AV_RB16(p) + 2;
+ if (p - avctx->extradata + nalsize > avctx->extradata_size)
+ return -1;
if (decode_nal_units(h, p, nalsize) < 0) {
av_log(avctx, AV_LOG_ERROR, "Decoding pps %d from avcC failed\n", i);
return -1;