diff options
| author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2010-07-10 16:43:00 +0000 |
|---|---|---|
| committer | Uoti Urpala <uau@glyph.nonexistent.invalid> | 2010-11-02 04:14:43 +0200 |
| commit | 5c53ce6bae5575fc708798221dba9e856a8caa8f (patch) | |
| tree | 03587e554146508d9a705a8afc3691ddccb90c52 | |
| parent | 5e95024317add19c376114c40a87e69d969c69ce (diff) | |
| download | mpv-5c53ce6bae5575fc708798221dba9e856a8caa8f.tar.bz2 mpv-5c53ce6bae5575fc708798221dba9e856a8caa8f.tar.xz | |
demux_ts: fix crash on broken packets
Check packet size before memmove to avoid crashes e.g. if we recognized the
wrong type and subtracted more header bytes than there are overall bytes.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@31669 b3059339-0415-0410-9bf9-f77b7e298cf2
| -rw-r--r-- | libmpdemux/demux_ts.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libmpdemux/demux_ts.c b/libmpdemux/demux_ts.c index 2daa7fd50b..31c2c534d1 100644 --- a/libmpdemux/demux_ts.c +++ b/libmpdemux/demux_ts.c @@ -3151,6 +3151,10 @@ static int ts_parse(demuxer_t *demuxer , ES_stream_t *es, unsigned char *packet, demuxer->filepos = stream_tell(demuxer->stream) - es->size; + if(es->size < 0 || es->size > buf_size) { + mp_msg(MSGT_DEMUX, MSGL_ERR, "Broken ES packet size\n"); + es->size = 0; + } memmove(p, es->start, es->size); *dp_offset += es->size; (*dp)->flags = 0; |