Commit bceb10aa04 for ffmpeg
commit bceb10aa04fdef4fc04d4684720b0640b1e95675
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed Oct 7 03:30:53 2026 +0200
avformat/rtpenc_vc2hq: Send the data unit that has no next parse offset
Not a security issue.
Found during triage of the security report HRhmcrDPRPyf
diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c
index 754e2098d5..f987468f10 100644
--- a/libavformat/rtpenc_vc2hq.c
+++ b/libavformat/rtpenc_vc2hq.c
@@ -124,6 +124,8 @@ void ff_rtp_send_vc2hq(AVFormatContext *ctx, const uint8_t *frame_buf, int frame
while (end - unit >= DIRAC_DATA_UNIT_HEADER_SIZE) {
parse_code = unit[4];
unit_size = AV_RB32(&unit[5]);
+ if (!unit_size)
+ unit_size = end - unit;
if (unit_size < DIRAC_DATA_UNIT_HEADER_SIZE || unit_size > end - unit)
break;