summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKlaus Schmidinger <vdr@tvdr.de>2012-01-12 12:25:54 +0100
committerKlaus Schmidinger <vdr@tvdr.de>2012-01-12 12:25:54 +0100
commit70d4e5105bddded33457342f9d6f1c7502d87b69 (patch)
tree7cf8bfbef57b73b7b656406e12bc30b3f40c3830
parent44da06f3848d84961f9ae829adc32b088f167ab6 (diff)
downloadvdr-70d4e5105bddded33457342f9d6f1c7502d87b69.tar.gz
vdr-70d4e5105bddded33457342f9d6f1c7502d87b69.tar.bz2
Fixed a possible memory corruption in cTsToPes::GetPes()
-rw-r--r--HISTORY2
-rw-r--r--remux.c6
2 files changed, 7 insertions, 1 deletions
diff --git a/HISTORY b/HISTORY
index b15ffa89..eb263c6e 100644
--- a/HISTORY
+++ b/HISTORY
@@ -6814,3 +6814,5 @@ Video Disk Recorder Revision History
with version 5.3 or higher that can handle the DTV_DVBT2_PLP_ID call (thanks
to Rolf Ahrenberg).
- Fixed cConfig::Load() for g++ version 4.7.0 (thanks to Ville Skyttä).
+- Fixed a possible memory corruption in cTsToPes::GetPes() in case of broken
+ TS packets, e.g. when switching channels.
diff --git a/remux.c b/remux.c
index 78ab2940..ff4d49ba 100644
--- a/remux.c
+++ b/remux.c
@@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
- * $Id: remux.c 2.62 2011/09/04 13:09:06 kls Exp $
+ * $Id: remux.c 2.63 2012/01/12 12:07:58 kls Exp $
*/
#include "remux.h"
@@ -701,6 +701,10 @@ const uchar *cTsToPes::GetPes(int &Length)
uchar *p = data + offset - 6;
if (p != data) {
p -= 3;
+ if (p < data) {
+ Reset();
+ return NULL;
+ }
memmove(p, data, 4);
}
int l = min(length - offset, MAXPESLENGTH);