[FFmpeg-cvslog] avformat/mpegts: fixes overflow when parsing the PMT
Nicolas Jorge Dato
git at videolan.org
Sat Sep 18 22:22:35 EEST 2021
ffmpeg | branch: master | Nicolas Jorge Dato <nicolas.dato at gmail.com> | Wed Sep 15 09:58:11 2021 -0300| [5a0a9f78252825dfe1824eedbc373aea443e5e77] | committer: Marton Balint
avformat/mpegts: fixes overflow when parsing the PMT
When a possible overflow was detected, there was a break to exit the while
loop. However, it should have already substracted 2 bytes from
program_info_length (descriptor ID + length).
Fixes ticket #9422.
Signed-off-by: Marton Balint <cus at passwd.hu>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5a0a9f78252825dfe1824eedbc373aea443e5e77
---
libavformat/mpegts.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index ed918cb356..da8eee2414 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -2355,10 +2355,11 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
av_log(ts->stream, AV_LOG_TRACE, "program tag: 0x%02x len=%d\n", tag, len);
- if (len > program_info_length - 2)
+ program_info_length -= 2;
+ if (len > program_info_length)
// something else is broken, exit the program_descriptors_loop
break;
- program_info_length -= len + 2;
+ program_info_length -= len;
if (tag == IOD_DESCRIPTOR) {
get8(&p, p_end); // scope
get8(&p, p_end); // label
More information about the ffmpeg-cvslog
mailing list