From 35ef53ab0b05f24af0afa8ca881769cf5479a194 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20=C3=96man?= Date: Wed, 21 Nov 2007 15:30:14 +0000 Subject: [PATCH] make sure adaptation field length stays within sane range --- tsdemux.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tsdemux.c b/tsdemux.c index 07b263aa..b10bb58a 100644 --- a/tsdemux.c +++ b/tsdemux.c @@ -134,13 +134,14 @@ ts_recv_packet(th_transport_t *t, int pid, uint8_t *tsb) pusi = tsb[1] & 0x40; + afl += 4; + switch(st->st_type) { case HTSTV_TABLE: if(st->st_section == NULL) st->st_section = calloc(1, sizeof(struct psi_section)); - afl += 4; if(err || afl >= 188) { st->st_section->ps_offset = -1; /* hold parser until next pusi */ break; @@ -169,7 +170,9 @@ ts_recv_packet(th_transport_t *t, int pid, uint8_t *tsb) break; default: - afl += 4; + if(afl > 188) + break; + ts_reassembly(t, st, tsb + afl, 188 - afl, pusi, err); break; }