From 5792d3b9c08ac2eefb793abdaee2e2ec6c48bd71 Mon Sep 17 00:00:00 2001 From: Stefan Kost Date: Fri, 20 May 2011 00:53:44 +0300 Subject: [PATCH] rtp: fix static array overruns Yes array[10] has elements from 0...9. --- gst/rtp/gstrtpjpegpay.c | 2 +- gst/rtp/gstrtpmp4adepay.c | 2 +- gst/rtp/gstrtpqcelpdepay.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gst/rtp/gstrtpjpegpay.c b/gst/rtp/gstrtpjpegpay.c index fc4096d..9a34447 100644 --- a/gst/rtp/gstrtpjpegpay.c +++ b/gst/rtp/gstrtpjpegpay.c @@ -716,7 +716,7 @@ gst_rtp_jpeg_pay_handle_buffer (GstBaseRTPPayload * basepayload, guint qt; qt = info[i].qt; - if (qt > 15) + if (qt > 14) goto invalid_quant; qsize = tables[qt].size; diff --git a/gst/rtp/gstrtpmp4adepay.c b/gst/rtp/gstrtpmp4adepay.c index 18ebfd2..edcd8db 100644 --- a/gst/rtp/gstrtpmp4adepay.c +++ b/gst/rtp/gstrtpmp4adepay.c @@ -229,7 +229,7 @@ gst_rtp_mp4a_depay_setcaps (GstBaseRTPDepayload * depayload, GstCaps * caps) if (!gst_bit_reader_get_bits_uint8 (&br, &sr_idx, 4)) goto bad_config; - if (sr_idx > 12 && sr_idx != 15) { + if (sr_idx > 11 && sr_idx != 15) { GST_WARNING_OBJECT (depayload, "invalid sample rate index %d", sr_idx); goto bad_config; } diff --git a/gst/rtp/gstrtpqcelpdepay.c b/gst/rtp/gstrtpqcelpdepay.c index 7949ae7..e83ed2c 100644 --- a/gst/rtp/gstrtpqcelpdepay.c +++ b/gst/rtp/gstrtpqcelpdepay.c @@ -164,7 +164,7 @@ static const gint frame_size[16] = { static gint get_frame_len (GstRtpQCELPDepay * depay, guint8 frame_type) { - if (frame_type > 16) + if (frame_type > 15) return 0; return frame_size[frame_type]; -- 2.7.4