From 891bd61076ea9567ec4f6b062a6c8d26c75de3a2 Mon Sep 17 00:00:00 2001 From: nicodvb Date: Sun, 29 Oct 2006 10:55:02 +0000 Subject: 1000l: fixed broken handling of the adaption field - part 2 The value of c must be between 0 and 183 inclusive; is c is 0 I can't skip c-1 bytes! git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@20503 b3059339-0415-0410-9bf9-f77b7e298cf2 --- libmpdemux/demux_ts.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'libmpdemux/demux_ts.c') diff --git a/libmpdemux/demux_ts.c b/libmpdemux/demux_ts.c index a2a5a4a193..ddbefb4c23 100644 --- a/libmpdemux/demux_ts.c +++ b/libmpdemux/demux_ts.c @@ -2633,14 +2633,24 @@ static int ts_parse(demuxer_t *demuxer , ES_stream_t *es, unsigned char *packet, int c; c = stream_read_char(stream); buf_size--; + if(c < 0 || c > 183) //broken from the stream layer or invalid + { + stream_skip(stream, buf_size-1+junk); + continue; + } + + //c==0 is allowed! + if(c > 0) + { rap_flag = (stream_read_char(stream) & 0x40) >> 6; buf_size--; - c = min(c-1, buf_size); + c--; stream_skip(stream, c); buf_size -= c; if(buf_size == 0) continue; + } } if(bad) -- cgit v1.2.3