diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 74ae4fafe4..f7f484e133 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1555,6 +1555,8 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type switch (desc_tag) { case 0x1E: /* SL descriptor */ desc_es_id = get16(pp, desc_end); + if (desc_es_id < 0) + break; if (ts && ts->pids[pid]) ts->pids[pid]->es_id = desc_es_id; for (i = 0; i < mp4_descr_count; i++) @@ -1573,7 +1575,8 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type } break; case 0x1F: /* FMC descriptor */ - get16(pp, desc_end); + if (get16(pp, desc_end) < 0) + break; if (mp4_descr_count > 0 && (st->codec->codec_id == AV_CODEC_ID_AAC_LATM || st->request_probe > 0) && mp4_descr->dec_config_descr_len && mp4_descr->es_id == pid) {