1 files changed, 18 insertions, 2 deletions
diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index 83cc687..8a67de7 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -74,12 +74,28 @@ void av_register_rtp_dynamic_payload_handlers(void)
 
 static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len)
 {
-    if (buf[1] != RTCP_SR)
-        return -1;
+    int payload_len;
+    while (len >= 2) {
+        switch (buf[1]) {
+        case RTCP_SR:
+            if (len < 16) {
+                av_log(NULL, AV_LOG_ERROR, "Invalid length for RTCP SR packet\n");
+                return AVERROR_INVALIDDATA;
+            }
+            payload_len = (AV_RB16(buf + 2) + 1) * 4;
+
     s->last_rtcp_ntp_time = AV_RB64(buf + 8);
     if (s->first_rtcp_ntp_time == AV_NOPTS_VALUE)
         s->first_rtcp_ntp_time = s->last_rtcp_ntp_time;
     s->last_rtcp_timestamp = AV_RB32(buf + 16);
+
+            buf += payload_len;
+            len -= payload_len;
+            break;
+        default:
+            return -1;
+        }
+    }
     return 0;
 }