avformat/rtpdec_h261: Fix sanity checks

Fixes mbap and quant Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
10 years ago · e15824e75b
parent 604c4eab2b
commit e15824e75b
1 changed files with 2 additions and 2 deletions
--- a/libavformat/rtpdec_h261.c
+++ b/libavformat/rtpdec_h261.c
@ -117,8 +117,8 @@ int ff_h261_handle_packet(AVFormatContext *ctx, PayloadContext *data,
    sbit  =  (buf[0] >> 5) & 0x07;
    ebit  =  (buf[0] >> 2) & 0x07;
    gobn  =  (buf[1] >> 4) & 0x0f;
-    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[1] >> 7) & 0x01);
-    quant =  (buf[1] >> 4) & 0x0f;
+    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01);
+    quant =  (buf[2] >> 2) & 0x1f;

    /* pass the H.261 payload header and continue with the actual payload */
    buf += RTP_H261_PAYLOAD_HEADER_SIZE;