2 files changed, 25 insertions, 1 deletions
diff --git a/src/demuxers/demux_asf.c b/src/demuxers/demux_asf.c
index 57624aa15..827557333 100644
--- a/src/demuxers/demux_asf.c
+++ b/src/demuxers/demux_asf.c
@@ -379,10 +379,21 @@ static int asf_read_header (demux_asf_t *this) {
   uint8_t *asf_header_buffer = NULL;
 
   asf_header_len = get_le64(this);
-  asf_header_buffer = alloca(asf_header_len);
+  if (asf_header_len > 4 * 1024 * 1024)
+  {
+    xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, 
+	    "demux_asf: asf_read_header: overly-large header? (%"PRIu64" bytes)\n",
+	    asf_header_len);
+    return 0;
+  }
+
+  asf_header_buffer = malloc (asf_header_len);
 
   if (this->input->read (this->input, asf_header_buffer, asf_header_len) != asf_header_len)
+  {
+    free (asf_header_buffer);
     return 0;
+  }
 
   /* delete previous header */
   if (this->asf_header) {
@@ -395,7 +406,11 @@ static int asf_read_header (demux_asf_t *this) {
    */
   this->asf_header = asf_header_new(asf_header_buffer, asf_header_len);
   if (!this->asf_header)
+  {
+    free (asf_header_buffer);
     return 0;
+  }
+  free (asf_header_buffer);
 
   lprintf("asf header parsing ok\n");
 
diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c
index e80e8af70..2f88c8963 100644
--- a/src/demuxers/demux_ts.c
+++ b/src/demuxers/demux_ts.c
@@ -1169,6 +1169,15 @@ printf("Program Number is %i, looking for %i\n",program_number,this->program_num
     return;
   }
 
+  if (!section_length) {
+    free (this->pmt[program_count]);
+    this->pmt[program_count] = NULL;
+#ifdef TS_PMT_LOG
+    printf ("ts_demux: eek, zero-length section?\n");
+#endif
+    return;
+  }
+
 #ifdef TS_PMT_LOG
   printf ("ts_demux: have all TS packets for the PMT section\n");
 #endif