We actually read 20 bytes of these packets.
Unified · Split
| @@ -115,7 +115,7 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int l · 114 unmodified lines | ||
| 115 | 115 | while (len >= 2) { |
| 116 | 116 | switch (buf[1]) { |
| 117 | 117 | case RTCP_SR: |
| 118 | − if (len < 16) { | |
| 118 | + if (len < 20) { | |
| 119 | 119 | av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n"); |
| 120 | 120 | return AVERROR_INVALIDDATA; |
| 121 | 121 | } |