hevc: Search start code in decode_nal_units().

User may cut off a weird position and send a packet from there.
This avoids returning as invalid data immediately.

1 files changed, 9 insertions, 8 deletions

diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index a395bc9..9a88867 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -2325,14 +2325,15 @@ static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
                 goto fail;
             }
         } else {
-            if (buf[2] == 0) {
-                length--;
-                buf++;
-                continue;
-            }
-            if (buf[0] != 0 || buf[1] != 0 || buf[2] != 1) {
-                ret = AVERROR_INVALIDDATA;
-                goto fail;
+            /* search start code */
+            while (buf[0] != 0 || buf[1] != 0 || buf[2] != 1) {
+                ++buf;
+                --length;
+                if (length < 4) {
+                    av_log(s->avctx, AV_LOG_ERROR, "No start code is found.\n");
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
+                }
             }
 
             buf    += 3;