From 603f6b2db04192e4790e977a0ace8d03352dbb89 Mon Sep 17 00:00:00 2001
From: phintuka <phintuka>
Date: Tue, 2 Aug 2011 17:48:28 +0000
Subject: added buffer size checks to adaptation field parsing

---
 xine/BluRay/demux_ts.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xine/BluRay/demux_ts.c b/xine/BluRay/demux_ts.c
index edd61e5f..57e3cec7 100644
--- a/xine/BluRay/demux_ts.c
+++ b/xine/BluRay/demux_ts.c
@@ -1882,6 +1882,9 @@ static int64_t demux_ts_adaptation_field_parse(uint8_t *data,
   }
 #endif
   if(PCR_flag) {
+    if (adaptation_field_length < offset + 6)
+      return 0;
+
     PCR  = (((int64_t) data[offset]) & 0xFF) << 25;
     PCR += (int64_t) ((data[offset+1] & 0xFF) << 17);
     PCR += (int64_t) ((data[offset+2] & 0xFF) << 9);
@@ -1896,6 +1899,9 @@ static int64_t demux_ts_adaptation_field_parse(uint8_t *data,
     offset+=6;
   }
   if(OPCR_flag) {
+    if (adaptation_field_length < offset + 6)
+      return PCR;
+
     OPCR = data[offset] << 25;
     OPCR |= data[offset+1] << 17;
     OPCR |= data[offset+2] << 9;
-- 
cgit v1.2.3