From e0abe0a02a6963955f1463d32c441fa22c1673a7 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Thu, 24 Apr 2025 20:36:52 +0200
Subject: [PATCH] lavf/rtpdec: fix RTCP SR packet length check

The minimum valid packet length is 28, given that the length includes
the packet header.

This didn't cause any issues so far as the code did not care about the
last two fields in the SR section, but will be relevant in a future
commit.
---
 libavformat/rtpdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index d54ac31eb0..5aecf7fbc7 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -187,7 +187,7 @@ static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf,
 
         switch (buf[1]) {
         case RTCP_SR:
-            if (payload_len < 20) {
+            if (payload_len < 28) {
                 av_log(s->ic, AV_LOG_ERROR, "Invalid RTCP SR packet length\n");
                 return AVERROR_INVALIDDATA;
             }