From 35ef53ab0b05f24af0afa8ca881769cf5479a194 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20=C3=96man?= <andreas@lonelycoder.com>
Date: Wed, 21 Nov 2007 15:30:14 +0000
Subject: [PATCH] make sure adaptation field length stays within sane range

---
 tsdemux.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tsdemux.c b/tsdemux.c
index 07b263aa..b10bb58a 100644
--- a/tsdemux.c
+++ b/tsdemux.c
@@ -134,13 +134,14 @@ ts_recv_packet(th_transport_t *t, int pid, uint8_t *tsb)
   
   pusi = tsb[1] & 0x40;
 
+  afl += 4;
+
   switch(st->st_type) {
 
   case HTSTV_TABLE:
     if(st->st_section == NULL)
       st->st_section = calloc(1, sizeof(struct psi_section));
 
-    afl += 4;
     if(err || afl >= 188) {
       st->st_section->ps_offset = -1; /* hold parser until next pusi */
       break;
@@ -169,7 +170,9 @@ ts_recv_packet(th_transport_t *t, int pid, uint8_t *tsb)
     break;
 
   default:
-    afl += 4;
+    if(afl > 188)
+      break;
+
     ts_reassembly(t, st, tsb + afl, 188 - afl, pusi, err);
     break;
   }