3 files changed, 33 insertions, 4 deletions
diff --git a/src/demuxers/demux_asf.c b/src/demuxers/demux_asf.c
index 57624aa15..827557333 100644
--- a/src/demuxers/demux_asf.c
+++ b/src/demuxers/demux_asf.c
@@ -379,10 +379,21 @@ static int asf_read_header (demux_asf_t *this) {
   uint8_t *asf_header_buffer = NULL;
 
   asf_header_len = get_le64(this);
-  asf_header_buffer = alloca(asf_header_len);
+  if (asf_header_len > 4 * 1024 * 1024)
+  {
+    xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, 
+	    "demux_asf: asf_read_header: overly-large header? (%"PRIu64" bytes)\n",
+	    asf_header_len);
+    return 0;
+  }
+
+  asf_header_buffer = malloc (asf_header_len);
 
   if (this->input->read (this->input, asf_header_buffer, asf_header_len) != asf_header_len)
+  {
+    free (asf_header_buffer);
     return 0;
+  }
 
   /* delete previous header */
   if (this->asf_header) {
@@ -395,7 +406,11 @@ static int asf_read_header (demux_asf_t *this) {
    */
   this->asf_header = asf_header_new(asf_header_buffer, asf_header_len);
   if (!this->asf_header)
+  {
+    free (asf_header_buffer);
     return 0;
+  }
+  free (asf_header_buffer);
 
   lprintf("asf header parsing ok\n");
 
diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c
index e80e8af70..2f88c8963 100644
--- a/src/demuxers/demux_ts.c
+++ b/src/demuxers/demux_ts.c
@@ -1169,6 +1169,15 @@ printf("Program Number is %i, looking for %i\n",program_number,this->program_num
     return;
   }
 
+  if (!section_length) {
+    free (this->pmt[program_count]);
+    this->pmt[program_count] = NULL;
+#ifdef TS_PMT_LOG
+    printf ("ts_demux: eek, zero-length section?\n");
+#endif
+    return;
+  }
+
 #ifdef TS_PMT_LOG
   printf ("ts_demux: have all TS packets for the PMT section\n");
 #endif
diff --git a/src/xine-engine/audio_out.c b/src/xine-engine/audio_out.c
index 5162c1883..855051582 100644
--- a/src/xine-engine/audio_out.c
+++ b/src/xine-engine/audio_out.c
@@ -291,6 +291,7 @@ struct audio_fifo_s {
   int                num_buffers;
 };
 
+static int ao_get_property (xine_audio_port_t *this_gen, int property);
 static int ao_set_property (xine_audio_port_t *this_gen, int property, int value);
 
 static audio_fifo_t *fifo_new (xine_t *xine) {
@@ -1614,13 +1615,17 @@ static void ao_close(xine_audio_port_t *this_gen, xine_stream_t *stream) {
     xprintf (this->xine, XINE_VERBOSITY_DEBUG, "audio_out: no streams left, closing driver\n");
 
     if (this->audio_loop_running) {
+      /* make sure there are no more buffers on queue */
       if (this->clock->speed == XINE_SPEED_PAUSE ||
           (this->clock->speed != XINE_FINE_SPEED_NORMAL && !this->slow_fast_audio)) {
-        /* discard buffers, otherwise we'll wait forever */
+        int discard = ao_get_property(this_gen, AO_PROP_DISCARD_BUFFERS);
+        /* discard buffers while waiting, otherwise we'll wait forever */
         ao_set_property(this_gen, AO_PROP_DISCARD_BUFFERS, 1);
+        fifo_wait_empty(this->out_fifo);
+        ao_set_property(this_gen, AO_PROP_DISCARD_BUFFERS, discard);
       }
-      /* make sure there are no more buffers on queue */
-      fifo_wait_empty(this->out_fifo);
+      else
+        fifo_wait_empty(this->out_fifo);
     }
 
     pthread_mutex_lock( &this->driver_lock );