diff options
| author | Klaus Schmidinger <vdr@tvdr.de> | 2010-05-13 14:39:41 +0200 |
|---|---|---|
| committer | Klaus Schmidinger <vdr@tvdr.de> | 2010-05-13 14:39:41 +0200 |
| commit | 539c0da85348b52534429bed7ff0a5ea24bbf00f (patch) | |
| tree | 78dfa10c6c122807ff7f95b173e31d425b1c0441 /remux.h | |
| parent | e2a995f3e7b56defa21c489e29d7618ca7ff022c (diff) | |
| download | vdr-539c0da85348b52534429bed7ff0a5ea24bbf00f.tar.gz vdr-539c0da85348b52534429bed7ff0a5ea24bbf00f.tar.bz2 | |
Fixed a possible out of buffer memory access in case of bad TS data
Diffstat (limited to 'remux.h')
| -rw-r--r-- | remux.h | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: remux.h 2.24 2010/01/29 16:51:26 kls Exp $ + * $Id: remux.h 2.25 2010/05/13 14:29:45 kls Exp $ */ #ifndef __REMUX_H @@ -84,7 +84,8 @@ inline bool TsIsScrambled(const uchar *p) inline int TsPayloadOffset(const uchar *p) { - return (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4; + int o = (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4; + return o <= TS_SIZE ? o : TS_SIZE; } inline int TsGetPayload(const uchar **p) |