[FFmpeg-cvslog] avformat/rtpdec_h261: Fix sanity checks

[ThomasVolkert]

ffmpeg | branch: master | ThomasVolkert <thomas at homer-conferencing.com> | Tue Aug 26 14:23:00 2014 +0200| [e15824e75b5549e53eb5c1ffb79766321ac8d122] | committer: Michael Niedermayer

avformat/rtpdec_h261: Fix sanity checks

Fixes mbap and quant

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e15824e75b5549e53eb5c1ffb79766321ac8d122
---

 libavformat/rtpdec_h261.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c
index c1d79a8..b902d2a 100644
--- a/libavformat/rtpdec_h261.c
+++ b/libavformat/rtpdec_h261.c
@@ -117,8 +117,8 @@ int ff_h261_handle_packet(AVFormatContext *ctx, PayloadContext *data,
     sbit  =  (buf[0] >> 5) & 0x07;
     ebit  =  (buf[0] >> 2) & 0x07;
     gobn  =  (buf[1] >> 4) & 0x0f;
-    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[1] >> 7) & 0x01);
-    quant =  (buf[1] >> 4) & 0x0f;
+    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01);
+    quant =  (buf[2] >> 2) & 0x1f;
 
     /* pass the H.261 payload header and continue with the actual payload */
     buf += RTP_H261_PAYLOAD_HEADER_SIZE;