[Bug 677560] [PATCH] rtpjpegdepay: crash in copy_into_unchecked

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=677560
  GStreamer | gst-plugins-good | 0.10.31

--- Comment #19 from Petteri Aimonen <jpa at gnobug.mail.kapsi.fi> 2013-04-22 06:32:41 UTC ---
Created an attachment (id=242118)
 View: https://bugzilla.gnome.org/attachment.cgi?id=242118
 Review: https://bugzilla.gnome.org/review?bug=677560&attachment=242118

Check for avail >= 2 in gstrtpjpegdepay

I have run into this same bug when streaming data gstreamer -> gstreamer with
MJPEG encoding over RTP & UDP.

To me, it seems that this bug occurs when 'avail' in gst_rtp_jpeg_depay_process
is less than 2. Then skip = -1, which causes the crash in copy_into_unchecked.
This can be seen in the backtrace as skip = 4294967294.

I think the attached patch should be more reasonable than the one proposed
earlier. These 0- or 1-byte images are obviously corrupted, but gstreamer
should still be able to continue and not crash.

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.