diff options
| -rw-r--r-- | CONTRIBUTORS | 1 | ||||
| -rw-r--r-- | HISTORY | 2 | ||||
| -rw-r--r-- | remux.c | 6 | ||||
| -rw-r--r-- | remux.h | 5 |
4 files changed, 11 insertions, 3 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS index ca12038d..b0603937 100644 --- a/CONTRIBUTORS +++ b/CONTRIBUTORS @@ -1094,6 +1094,7 @@ Rolf Ahrenberg <rahrenbe@cc.hut.fi> for keeping subtitles visible when pausing replay for suggesting to assign the source character 'I' to "IPTV" for fixing generating PMT language descriptors for multi language PIDs + for reporting a possible out of buffer memory access in case of bad TS data Ralf Klueber <ralf.klueber@vodafone.com> for reporting a bug in cutting a recording if there is only a single editing mark @@ -6451,3 +6451,5 @@ Video Disk Recorder Revision History - Fixed a crash when creating a new channel if the channel list is empty (reported by Halim Sahin). - Updated the Czech OSD texts (thanks to Radek Stastny). +- Fixed a possible out of buffer memory access in case of bad TS data (reported + by Rolf Ahrenberg). @@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: remux.c 2.44 2010/04/18 13:40:20 kls Exp $ + * $Id: remux.c 2.45 2010/05/13 14:16:56 kls Exp $ */ #include "remux.h" @@ -663,6 +663,10 @@ void cTsToPes::PutTs(const uchar *Data, int Length) if (length + Length > size) { size = max(KILOBYTE(2), length + Length); data = (uchar *)realloc(data, size); + if (!data) { + Reset(); + return; + } } memcpy(data + length, Data, Length); length += Length; @@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: remux.h 2.24 2010/01/29 16:51:26 kls Exp $ + * $Id: remux.h 2.25 2010/05/13 14:29:45 kls Exp $ */ #ifndef __REMUX_H @@ -84,7 +84,8 @@ inline bool TsIsScrambled(const uchar *p) inline int TsPayloadOffset(const uchar *p) { - return (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4; + int o = (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4; + return o <= TS_SIZE ? o : TS_SIZE; } inline int TsGetPayload(const uchar **p) |