Fixed a possible memory corruption in cTsToPes::GetPes()

2 files changed, 7 insertions, 1 deletions

diff --git a/HISTORY b/HISTORY
index b15ffa89..eb263c6e 100644
--- a/HISTORY
+++ b/HISTORY
@@ -6814,3 +6814,5 @@ Video Disk Recorder Revision History
   with version 5.3 or higher that can handle the DTV_DVBT2_PLP_ID call (thanks
   to Rolf Ahrenberg).
 - Fixed cConfig::Load() for g++ version 4.7.0 (thanks to Ville Skyttä).
+- Fixed a possible memory corruption in cTsToPes::GetPes() in case of broken
+  TS packets, e.g. when switching channels.
diff --git a/remux.c b/remux.c
index 78ab2940..ff4d49ba 100644
--- a/remux.c
+++ b/remux.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: remux.c 2.62 2011/09/04 13:09:06 kls Exp $
+ * $Id: remux.c 2.63 2012/01/12 12:07:58 kls Exp $
  */
 
 #include "remux.h"
@@ -701,6 +701,10 @@ const uchar *cTsToPes::GetPes(int &Length)
         uchar *p = data + offset - 6;
         if (p != data) {
            p -= 3;
+           if (p < data) {
+              Reset();
+              return NULL;
+              }
            memmove(p, data, 4);
            }
         int l = min(length - offset, MAXPESLENGTH);