@@ -32,7 +32,7 @@ void sendHeaders(uint8_t **buf, int *len, int nalNum) {
32
32
int headersLen = 0 ;
33
33
int foundHeaders = -1 ; // Offset by 1 header to find the length until the next header
34
34
while (b != end) {
35
- if (memcmp (b, NAL_HEADER, sizeof (NAL_HEADER)) == 0 ) {
35
+ if (b + sizeof (NAL_HEADER) <= end && memcmp (b, NAL_HEADER, sizeof (NAL_HEADER)) == 0 ) {
36
36
foundHeaders++;
37
37
if (foundHeaders == nalNum) {
38
38
break ;
@@ -58,8 +58,8 @@ void processH264Nals(uint8_t **buf, int *len) {
58
58
uint8_t *b = *buf;
59
59
int l = *len;
60
60
uint8_t nalType = b[4 ] & 0x1F ;
61
-
62
- if (nalType == H264_NAL_TYPE_AUD) {
61
+
62
+ if (nalType == H264_NAL_TYPE_AUD && l > sizeof (NAL_HEADER) * 2 + 2 ) {
63
63
b += sizeof (NAL_HEADER) + 2 ;
64
64
l -= sizeof (NAL_HEADER) + 2 ;
65
65
nalType = b[4 ] & 0x1F ;
@@ -75,8 +75,8 @@ void processH265Nals(uint8_t **buf, int *len) {
75
75
uint8_t *b = *buf;
76
76
int l = *len;
77
77
uint8_t nalType = (b[4 ] >> 1 ) & 0x3F ;
78
-
79
- if (nalType == H265_NAL_TYPE_AUD) {
78
+
79
+ if (nalType == H265_NAL_TYPE_AUD && l > sizeof (NAL_HEADER) * 2 + 3 ) {
80
80
b += sizeof (NAL_HEADER) + 3 ;
81
81
l -= sizeof (NAL_HEADER) + 3 ;
82
82
nalType = (b[4 ] >> 1 ) & 0x3F ;
@@ -92,6 +92,10 @@ void ClientConnection::SendVideo(uint8_t *buf, int len, uint64_t targetTimestamp
92
92
// Report before the frame is packetized
93
93
ReportEncoded (targetTimestampNs);
94
94
95
+ if (len < sizeof (NAL_HEADER)) {
96
+ return ;
97
+ }
98
+
95
99
int codec = Settings::Instance ().m_codec ;
96
100
if (codec == ALVR_CODEC_H264) {
97
101
processH264Nals (&buf, &len);
0 commit comments