Fix Stack off-by-one overflow in vc1 packetizer

Pointed-By: Clément Lecigne

diff --git a/modules/packetizer/vc1.c b/modules/packetizer/vc1.c
index e3c7daa0942c3386418136f193a0d046715f5d85..0859f68bbaeb0414a194fb8b86b91e1c8a515d20 100644 (file)
--- a/modules/packetizer/vc1.c
+++ b/modules/packetizer/vc1.c
@@ -285,7 +285,7 @@ static void DecodeRIDU( uint8_t *p_ret, int *pi_ret, uint8_t *src, int i_src )
     while( src < end && dst < dst_end )
     {
         if( src < end - 3 && src[0] == 0x00 && src[1] == 0x00 &&
-            src[2] == 0x03 )
+            src[2] == 0x03 && dst < dst_end - 1 )
         {
             *dst++ = 0x00;
             *dst++ = 0x00;