[FFmpeg-cvslog] avformat/rtpdec_rfc4175: Fix incorrect copy_offset calculation

[Jacob Siddall]

ffmpeg | branch: master | Jacob Siddall <kobe at live.com.au> | Thu Jun 27 06:06:22 2019 +0000| [9051092e73666e95986eb2d596cc0867aea05c3d] | committer: Michael Niedermayer

avformat/rtpdec_rfc4175: Fix incorrect copy_offset calculation

The previous calculation code did not account for the fact that the
copy_offset for the start of the frame array is at index 0, yet the
scan line number from the rfc4175 RTP header starts at 1.
This caused 2 issues to appear:
- The first scan line was being copied into the array where the second
  scan line should be. This caused the resulting video to have a green
  line at the top of it.
- Since the packet containing the last scan line would fail the
  calculation, the packet with the RTP marker would not be processed
  which caused a log message saying "Missed previous RTP marker" to be
  outputted for each frame.

Signed-off-by: Jacob Siddall <kobe at live.com.au>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9051092e73666e95986eb2d596cc0867aea05c3d
---

 libavformat/rtpdec_rfc4175.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index e9c62c1389..490db87520 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -205,8 +205,11 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data,
         if (length > payload_len)
             length = payload_len;
 
+        if (line < 1)
+            return AVERROR_INVALIDDATA;
+
         /* prevent ill-formed packets to write after buffer's end */
-        copy_offset = (line * data->width + offset) * data->pgroup / data->xinc;
+        copy_offset = ((line - 1) * data->width + offset) * data->pgroup / data->xinc;
         if (copy_offset + length > data->frame_size)
             return AVERROR_INVALIDDATA;