[FFmpeg-devel] [PATCH] avformat/rtpdec_h261: sanity checks

[Thomas Volkert]

From: ThomasVolkert <thomas at homer-conferencing.com>

---
 libavformat/rtpdec_h261.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c
index c1d79a8..b902d2a 100644
--- a/libavformat/rtpdec_h261.c
+++ b/libavformat/rtpdec_h261.c
@@ -117,8 +117,8 @@ int ff_h261_handle_packet(AVFormatContext *ctx, PayloadContext *data,
     sbit  =  (buf[0] >> 5) & 0x07;
     ebit  =  (buf[0] >> 2) & 0x07;
     gobn  =  (buf[1] >> 4) & 0x0f;
-    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[1] >> 7) & 0x01);
-    quant =  (buf[1] >> 4) & 0x0f;
+    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01);
+    quant =  (buf[2] >> 2) & 0x1f;
 
     /* pass the H.261 payload header and continue with the actual payload */
     buf += RTP_H261_PAYLOAD_HEADER_SIZE;
-- 
1.9.1