[SCM] libav/experimental: Fix a crash in the H.263 RTP packetizer

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 34056cbba55f0131e8d2698717ab9e86e2da5178
Author: Martin Storsjö <martin at martin.st>
Date:   Thu Mar 11 16:26:14 2010 +0000

    Fix a crash in the H.263 RTP packetizer
    
    If size == 1 and buf[0] == 0 and buf[1] == 0 (the first byte after the
    buffer), it would set size = -1 and crash in the later memcpy.
    
    Originally committed as revision 22469 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/rtpenc_h263.c b/libavformat/rtpenc_h263.c
index 0ea4921..84403a1 100644
--- a/libavformat/rtpenc_h263.c
+++ b/libavformat/rtpenc_h263.c
@@ -50,7 +50,7 @@ void ff_rtp_send_h263(AVFormatContext *s1, const uint8_t *buf1, int size)
 
     while (size > 0) {
         q = s->buf;
-        if ((buf1[0] == 0) && (buf1[1] == 0)) {
+        if (size >= 2 && (buf1[0] == 0) && (buf1[1] == 0)) {
             *q++ = 0x04;
             buf1 += 2;
             size -= 2;

-- 
Libav/FFmpeg packaging