diff options
| author | Petri Hintukainen <phintuka@users.sourceforge.net> | 2011-08-02 15:42:21 +0300 |
|---|---|---|
| committer | Petri Hintukainen <phintuka@users.sourceforge.net> | 2011-08-02 15:42:21 +0300 |
| commit | dc086c7f3808b2da888f2e496edd7fef69b038c0 (patch) | |
| tree | 8a9cec342bfe1488d7be37ff9f45ca063c7705de | |
| parent | c59f362c07750c0497973b47ee96a6ef632cd533 (diff) | |
| download | xine-lib-dc086c7f3808b2da888f2e496edd7fef69b038c0.tar.gz xine-lib-dc086c7f3808b2da888f2e496edd7fef69b038c0.tar.bz2 | |
demux_ts: added buffer size checks to adaptation field parsing
| -rw-r--r-- | src/demuxers/demux_ts.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c index 52b07a437..d5af1615e 100644 --- a/src/demuxers/demux_ts.c +++ b/src/demuxers/demux_ts.c @@ -1806,6 +1806,9 @@ static int64_t demux_ts_adaptation_field_parse(uint8_t *data, } #endif if(PCR_flag) { + if (adaptation_field_length < offset + 6) + return 0; + PCR = (((int64_t) data[offset]) & 0xFF) << 25; PCR += (int64_t) ((data[offset+1] & 0xFF) << 17); PCR += (int64_t) ((data[offset+2] & 0xFF) << 9); @@ -1820,6 +1823,9 @@ static int64_t demux_ts_adaptation_field_parse(uint8_t *data, offset+=6; } if(OPCR_flag) { + if (adaptation_field_length < offset + 6) + return PCR; + OPCR = data[offset] << 25; OPCR |= data[offset+1] << 17; OPCR |= data[offset+2] << 9; |