demux_ts: Added buffer size checks. Make sure buffer size is not set to

negative value (that results writing out of buffer when buffering
payload). Check buffer size before checking substream header bytes.

1 files changed, 15 insertions, 0 deletions

diff --git a/xine/BluRay/demux_ts.c b/xine/BluRay/demux_ts.c
index 12c11469..9803ad1e 100644
--- a/xine/BluRay/demux_ts.c
+++ b/xine/BluRay/demux_ts.c
@@ -870,8 +870,15 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m,
       m->type |= BUF_AUDIO_DTS;
       return 1;
 
+    } else if (packet_len < 2) {
+      return 0;
+
     } else if (m->descriptor_tag == HDMV_AUDIO_80_PCM) {
 
+      if (packet_len < 4) {
+        return 0;
+      }
+
       m->content = p + 4;
       m->size    = packet_len - 4;
       m->type   |= BUF_AUDIO_LPCM_BE;
@@ -901,6 +908,10 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m,
       return 1;
     } else if ((p[0] & 0xF0) == 0x80) {
 
+      if (packet_len < 4) {
+        return 0;
+      }
+
       m->content   = p+4;
       m->size      = packet_len - 4;
       m->type      |= BUF_AUDIO_A52;
@@ -917,6 +928,10 @@ static int demux_ts_parse_pes_header (xine_t *xine, demux_ts_media *m,
         }
       }
 
+      if (packet_len < pcm_offset) {
+        return 0;
+      }
+
       m->content   = p+pcm_offset;
       m->size      = packet_len-pcm_offset;
       m->type      |= BUF_AUDIO_LPCM_BE;