- tk->fmt.i_extra = qtState.sdAtomSize - 16;
- tk->fmt.p_extra = malloc( tk->fmt.i_extra );
- memcpy( tk->fmt.p_extra, &sdAtom[12], tk->fmt.i_extra );
-
+ if( tk->fmt.i_codec == VLC_FOURCC('a', 'v', 'c', '1') )
+ {
+ uint8_t *pos = (uint8_t*)qtRTPSource->qtState.sdAtom + 86;
+ uint8_t *endpos = (uint8_t*)qtRTPSource->qtState.sdAtom
+ + qtRTPSource->qtState.sdAtomSize;
+ while (pos+8 < endpos) {
+ unsigned atomLength = pos[0]<<24 | pos[1]<<16 | pos[2]<<8 | pos[3];
+ if( atomLength == 0 || atomLength > endpos-pos) break;
+ if( memcmp(pos+4, "avcC", 4) == 0 &&
+ atomLength > 8 &&
+ atomLength <= INT_MAX-sizeof(BITMAPINFOHEADER))
+ {
+ tk->fmt.i_extra = atomLength-8;
+ tk->fmt.p_extra = malloc( tk->fmt.i_extra );
+ memcpy(tk->fmt.p_extra, pos+8, atomLength-8);
+ break;
+ }
+ pos += atomLength;
+ }
+ }
+ else
+ {
+ tk->fmt.i_extra = qtState.sdAtomSize - 16;
+ tk->fmt.p_extra = malloc( tk->fmt.i_extra );
+ memcpy( tk->fmt.p_extra, &sdAtom[12], tk->fmt.i_extra );
+ }