@@ -32,7 +32,7 @@ void sendHeaders(uint8_t **buf, int *len, int nalNum) {
32
32
int headersLen = 0 ;
33
33
int foundHeaders = -1 ; // Offset by 1 header to find the length until the next header
34
34
while (b != end) {
35
- if (memcmp (b, NAL_HEADER, sizeof (NAL_HEADER)) == 0 ) {
35
+ if (b + sizeof (NAL_HEADER) <= end && memcmp (b, NAL_HEADER, sizeof (NAL_HEADER)) == 0 ) {
36
36
foundHeaders++;
37
37
if (foundHeaders == nalNum) {
38
38
break ;
@@ -58,11 +58,16 @@ void processH264Nals(uint8_t **buf, int *len) {
58
58
uint8_t *b = *buf;
59
59
int l = *len;
60
60
uint8_t nalType = b[4 ] & 0x1F ;
61
-
61
+
62
62
if (nalType == H264_NAL_TYPE_AUD) {
63
- b += sizeof (NAL_HEADER) + 2 ;
64
- l -= sizeof (NAL_HEADER) + 2 ;
65
- nalType = b[4 ] & 0x1F ;
63
+ uint8_t nalSize = sizeof (NAL_HEADER) + 2 ;
64
+ if (l >= nalSize) {
65
+ b += nalSize;
66
+ l -= nalSize;
67
+ }
68
+ if (l > sizeof (NAL_HEADER)) {
69
+ nalType = b[4 ] & 0x1F ;
70
+ }
66
71
}
67
72
if (nalType == H264_NAL_TYPE_SPS) {
68
73
sendHeaders (&b, &l, 2 ); // 2 headers SPS and PPS
@@ -75,11 +80,16 @@ void processH265Nals(uint8_t **buf, int *len) {
75
80
uint8_t *b = *buf;
76
81
int l = *len;
77
82
uint8_t nalType = (b[4 ] >> 1 ) & 0x3F ;
78
-
83
+
79
84
if (nalType == H265_NAL_TYPE_AUD) {
80
- b += sizeof (NAL_HEADER) + 3 ;
81
- l -= sizeof (NAL_HEADER) + 3 ;
82
- nalType = (b[4 ] >> 1 ) & 0x3F ;
85
+ uint8_t nalSize = sizeof (NAL_HEADER) + 3 ;
86
+ if (l >= nalSize) {
87
+ b += nalSize;
88
+ l -= nalSize;
89
+ }
90
+ if (l > sizeof (NAL_HEADER)) {
91
+ nalType = (b[4 ] >> 1 ) & 0x3F ;
92
+ }
83
93
}
84
94
if (nalType == H265_NAL_TYPE_VPS) {
85
95
sendHeaders (&b, &l, 3 ); // 3 headers VPS, SPS and PPS
@@ -92,6 +102,10 @@ void ClientConnection::SendVideo(uint8_t *buf, int len, uint64_t targetTimestamp
92
102
// Report before the frame is packetized
93
103
ReportEncoded (targetTimestampNs);
94
104
105
+ if (len < sizeof (NAL_HEADER)) {
106
+ return ;
107
+ }
108
+
95
109
int codec = Settings::Instance ().m_codec ;
96
110
if (codec == ALVR_CODEC_H264) {
97
111
processH264Nals (&buf, &len);
0 commit comments