demux_ts: Fixed reading outside of buffer. Checking if pes header length == 6 is not enough ; anything less than 9 is invalid (header length byte at [8] can't be used if it is outside of buffer). Moved check to beginning of parse_pes_header() to avoid reading outside of buffer.

1 files changed, 6 insertions, 7 deletions

diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c
index 49a7e0bd4..f46c5d4f2 100644
--- a/src/demuxers/demux_ts.c
+++ b/src/demuxers/demux_ts.c
@@ -699,6 +699,12 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m,
   uint32_t       stream_id;
   int            pkt_len;
 
+  if (packet_len < 9) {
+    xprintf (xine, XINE_VERBOSITY_DEBUG,
+	     "demux_ts: too short PES packet header (%d bytes)\n", packet_len);
+    return 0;
+  }
+
   p = buf;
   pkt_len = packet_len;
 
@@ -714,13 +720,6 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m,
   /* packet_len = p[4] << 8 | p[5]; */
   stream_id  = p[3];
 
-  if (packet_len==0)
-  {
-    xprintf (xine, XINE_VERBOSITY_DEBUG,
-             "demux_ts: error pes length 0\n");
-    return 0;
-  }
-
 #ifdef TS_LOG
   printf ("demux_ts: packet stream id: %.2x len: %d (%x)\n",
           stream_id, packet_len, packet_len);