diff --git a/src/input/mpegts/satip/satip_frontend.c b/src/input/mpegts/satip/satip_frontend.c index f658e59b..23b7a2ed 100644 --- a/src/input/mpegts/satip/satip_frontend.c +++ b/src/input/mpegts/satip/satip_frontend.c @@ -703,11 +703,12 @@ satip_frontend_decode_rtcp( satip_frontend_t *lfe, const char *name, if ((rtcp[0] & 0xc0) != 0x80) /* protocol version: v2 */ return; l = (((rtcp[2] << 8) | rtcp[3]) + 1) * 4; /* length of payload */ - if (l > len) - return; if (rtcp[1] == 204 && l > 20 && /* packet type */ rtcp[8] == 'S' && rtcp[9] == 'E' && rtcp[10] == 'S' && rtcp[11] == '1') { + /* workaround for broken minisatip */ + if (l > len && l - 4 != len) + return; sl = (rtcp[14] << 8) | rtcp[15]; if (sl > 0 && l - 16 >= sl) { rtcp[sl + 16] = '\0';