|  | @@ -205,11 +205,8 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data, | 
														
													
														
															
																|  |  | if (length > payload_len) |  |  | if (length > payload_len) | 
														
													
														
															
																|  |  | length = payload_len; |  |  | length = payload_len; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | if (line < 1) |  |  |  | 
														
													
														
															
																|  |  | return AVERROR_INVALIDDATA; |  |  |  | 
														
													
														
															
																|  |  | 
 |  |  |  | 
														
													
														
															
																|  |  | /* prevent ill-formed packets to write after buffer's end */ |  |  | /* prevent ill-formed packets to write after buffer's end */ | 
														
													
														
															
																|  |  | copy_offset = ((line - 1) * data->width + offset) * data->pgroup / data->xinc; |  |  |  | 
														
													
														
															
																|  |  |  |  |  | copy_offset = (line * data->width + offset) * data->pgroup / data->xinc; | 
														
													
														
															
																|  |  | if (copy_offset + length > data->frame_size) |  |  | if (copy_offset + length > data->frame_size) | 
														
													
														
															
																|  |  | return AVERROR_INVALIDDATA; |  |  | return AVERROR_INVALIDDATA; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
												
													
														
															
																|  | 
 |