mirror of https://github.com/mpv-player/mpv
demux_ts: fix crash on broken packets
Check packet size before memmove to avoid crashes e.g. if we recognized the wrong type and subtracted more header bytes than there are overall bytes. git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@31669 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
parent
5e95024317
commit
5c53ce6bae
|
@ -3151,6 +3151,10 @@ static int ts_parse(demuxer_t *demuxer , ES_stream_t *es, unsigned char *packet,
|
|||
|
||||
demuxer->filepos = stream_tell(demuxer->stream) - es->size;
|
||||
|
||||
if(es->size < 0 || es->size > buf_size) {
|
||||
mp_msg(MSGT_DEMUX, MSGL_ERR, "Broken ES packet size\n");
|
||||
es->size = 0;
|
||||
}
|
||||
memmove(p, es->start, es->size);
|
||||
*dp_offset += es->size;
|
||||
(*dp)->flags = 0;
|
||||
|
|
Loading…
Reference in New Issue