From d44db0265ba59bd7ca7a8c5b3f11921cc66a6d00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20=C3=96man?= <andreas@lonelycoder.com>
Date: Tue, 27 Nov 2007 11:07:57 +0000
Subject: [PATCH] bail out if duration is too big

---
 pes.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/pes.c b/pes.c
index ec0916d8..74ff6b92 100644
--- a/pes.c
+++ b/pes.c
@@ -97,6 +97,24 @@ pes_packet_input(th_transport_t *t, th_stream_t *st, uint8_t *buf, size_t len)
   if((flags & 0xc0) == 0xc0) {
     if(hlen < 10) 
       return -1;
+#if 0 /* write a more robust DTS/PTS decode which checks for 
+	 correct static bits */
+
+    u8 = getu8(buf, len);
+    if(u8 >> 4 != 3) {
+      printf("DTSPTS error\n");
+      return -1;
+    }
+
+    pts = (int64_t)(u8 & 0xe) << 29;
+    u16 = getu16(buf, len);
+    if((u16 & 1) == 0) {
+      printf("DTSPTS error\n");
+      return -1;
+    }
+#endif
+    
+    
 
     pts = getpts(buf, len);
     dts = getpts(buf, len);
@@ -134,7 +152,7 @@ pes_packet_input(th_transport_t *t, th_stream_t *st, uint8_t *buf, size_t len)
     }
 
     st->st_dts = dts;
-   
+    
     pts = dts + ptsoff;
 
     dts = av_rescale_q(dts, mpeg_tc, AV_TIME_BASE_Q);
@@ -318,7 +336,7 @@ pes_compute_duration(th_transport_t *t, th_stream_t *st, th_pkt_t *pkt)
 
   TAILQ_REMOVE(&st->st_durationq, pkt, pkt_queue_link);
 
-  if(pkt->pkt_duration < 1) {
+  if(pkt->pkt_duration < 1 || pkt->pkt_duration > 500000) {
     pkt_deref(pkt);
     return;
   }