summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKlaus Schmidinger <vdr@tvdr.de>2009-01-23 14:34:05 +0100
committerKlaus Schmidinger <vdr@tvdr.de>2009-01-23 14:34:05 +0100
commit4895d6b9e2c90376f0a639ee5a9bd74d9701cf09 (patch)
tree873febfe55039ed83c80d8c77425250beb236ac6
parenta1e7922938187e6d45e3e6603ca2aa0656fb7f71 (diff)
downloadvdr-4895d6b9e2c90376f0a639ee5a9bd74d9701cf09.tar.gz
vdr-4895d6b9e2c90376f0a639ee5a9bd74d9701cf09.tar.bz2
Checking the remaining packet length after processing the pointer field
-rw-r--r--HISTORY3
-rw-r--r--remux.c7
2 files changed, 8 insertions, 2 deletions
diff --git a/HISTORY b/HISTORY
index 7739d98d..4e30d8de 100644
--- a/HISTORY
+++ b/HISTORY
@@ -5947,3 +5947,6 @@ Video Disk Recorder Revision History
Nissl for pointing this out).
- Fixed handling the pointer field in cPatPmtParser::ParsePmt() (thanks to Frank
Schmirler - sorry I swapped two lines whan adopting the original patch).
+- Checking the remaining packet length after processing the pointer field in
+ cPatPmtParser::ParsePat() and cPatPmtParser::ParsePmt() (suggested by Frank
+ Schmirler).
diff --git a/remux.c b/remux.c
index b9062a3a..ed5da26a 100644
--- a/remux.c
+++ b/remux.c
@@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
- * $Id: remux.c 2.8 2009/01/23 14:17:07 kls Exp $
+ * $Id: remux.c 2.9 2009/01/23 14:31:43 kls Exp $
*/
#include "remux.h"
@@ -338,6 +338,8 @@ cPatPmtParser::cPatPmtParser(void)
void cPatPmtParser::ParsePat(const uchar *Data, int Length)
{
// The PAT is always assumed to fit into a single TS packet
+ if ((Length -= Data[0] + 1) <= 0)
+ return;
Data += Data[0] + 1; // process pointer_field
SI::PAT Pat(Data, false);
if (Pat.CheckCRCAndParse()) {
@@ -359,7 +361,8 @@ void cPatPmtParser::ParsePmt(const uchar *Data, int Length)
{
// The PMT may extend over several TS packets, so we need to assemble them
if (pmtSize == 0) {
- Length -= Data[0] + 1;
+ if ((Length -= Data[0] + 1) <= 0)
+ return;
Data += Data[0] + 1; // this is the first packet
if (SectionLength(Data, Length) > Length) {
if (Length <= int(sizeof(pmt))) {