RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

demux_ts: fix crash on broken packets 

Check packet size before memmove to avoid crashes e.g. if we recognized the
wrong type and subtracted more header bytes than there are overall bytes.

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@31669 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
reimar 2010-07-10 16:43:00 +00:00 committed by Uoti Urpala
parent 5e95024317
commit 5c53ce6bae
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libmpdemux/demux_ts.c
View File

@ -3151,6 +3151,10 @@ static int ts_parse(demuxer_t *demuxer , ES_stream_t *es, unsigned char *packet,
demuxer->filepos = stream_tell(demuxer->stream) - es->size;
if(es->size < 0 || es->size > buf_size) {
mp_msg(MSGT_DEMUX, MSGL_ERR, "Broken ES packet size\n");
es->size = 0;
}
memmove(p, es->start, es->size);
*dp_offset += es->size;
(*dp)->flags = 0;