From 240d3b758cbb5d31523fa592a797732203835f6d Mon Sep 17 00:00:00 2001 From: Petri Hintukainen Date: Sat, 16 Jul 2011 13:00:26 +0300 Subject: demux_ts: Fixed reading outside of buffer. Checking if pes header length == 6 is not enough ; anything less than 9 is invalid (header length byte at [8] can't be used if it is outside of buffer). Moved check to beginning of parse_pes_header() to avoid reading outside of buffer. --- src/demuxers/demux_ts.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c index 49a7e0bd4..f46c5d4f2 100644 --- a/src/demuxers/demux_ts.c +++ b/src/demuxers/demux_ts.c @@ -699,6 +699,12 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m, uint32_t stream_id; int pkt_len; + if (packet_len < 9) { + xprintf (xine, XINE_VERBOSITY_DEBUG, + "demux_ts: too short PES packet header (%d bytes)\n", packet_len); + return 0; + } + p = buf; pkt_len = packet_len; @@ -714,13 +720,6 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m, /* packet_len = p[4] << 8 | p[5]; */ stream_id = p[3]; - if (packet_len==0) - { - xprintf (xine, XINE_VERBOSITY_DEBUG, - "demux_ts: error pes length 0\n"); - return 0; - } - #ifdef TS_LOG printf ("demux_ts: packet stream id: %.2x len: %d (%x)\n", stream_id, packet_len, packet_len); -- cgit v1.2.3