RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mpegts: fixes overflow when parsing the PMT 

When a possible overflow was detected, there was a break to exit the while
loop. However, it should have already substracted 2 bytes from
program_info_length (descriptor ID + length).

Fixes ticket #9422.

Signed-off-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Nicolas Jorge Dato 2021-09-15 09:58:11 -03:00 committed by Marton Balint
parent 7bbad32d5a
commit 5a0a9f7825
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/mpegts.c
View File

@ -2355,10 +2355,11 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
av_log(ts->stream, AV_LOG_TRACE, "program tag: 0x%02x len=%d\n", tag, len);
if (len > program_info_length - 2)
program_info_length -= 2;
if (len > program_info_length)
// something else is broken, exit the program_descriptors_loop
break;
program_info_length -= len + 2;
program_info_length -= len;
if (tag == IOD_DESCRIPTOR) {
get8(&p, p_end); // scope
get8(&p, p_end); // label