Checking the remaining packet length after processing the pointer field

2 files changed, 8 insertions, 2 deletions

diff --git a/HISTORY b/HISTORY
index 7739d98d..4e30d8de 100644
--- a/HISTORY
+++ b/HISTORY
@@ -5947,3 +5947,6 @@ Video Disk Recorder Revision History
   Nissl for pointing this out).
 - Fixed handling the pointer field in cPatPmtParser::ParsePmt() (thanks to Frank
   Schmirler - sorry I swapped two lines whan adopting the original patch).
+- Checking the remaining packet length after processing the pointer field in
+  cPatPmtParser::ParsePat() and cPatPmtParser::ParsePmt() (suggested by Frank
+  Schmirler).
diff --git a/remux.c b/remux.c
index b9062a3a..ed5da26a 100644
--- a/remux.c
+++ b/remux.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: remux.c 2.8 2009/01/23 14:17:07 kls Exp $
+ * $Id: remux.c 2.9 2009/01/23 14:31:43 kls Exp $
  */
 
 #include "remux.h"
@@ -338,6 +338,8 @@ cPatPmtParser::cPatPmtParser(void)
 void cPatPmtParser::ParsePat(const uchar *Data, int Length)
 {
   // The PAT is always assumed to fit into a single TS packet
+  if ((Length -= Data[0] + 1) <= 0)
+     return;
   Data += Data[0] + 1; // process pointer_field
   SI::PAT Pat(Data, false);
   if (Pat.CheckCRCAndParse()) {
@@ -359,7 +361,8 @@ void cPatPmtParser::ParsePmt(const uchar *Data, int Length)
 {
   // The PMT may extend over several TS packets, so we need to assemble them
   if (pmtSize == 0) {
-     Length -= Data[0] + 1;
+     if ((Length -= Data[0] + 1) <= 0)
+        return;
      Data += Data[0] + 1; // this is the first packet
      if (SectionLength(Data, Length) > Length) {
         if (Length <= int(sizeof(pmt))) {