[MPlayer-cvslog] r31671 - trunk/libmpdemux/demux_ts.c

[Reimar Döffinger]

On Sat, Jul 10, 2010 at 11:36:25PM +0200, Nico Sabbi wrote:
> reimar ha scritto:
> >Author: reimar
> >Date: Sat Jul 10 18:48:59 2010
> >New Revision: 31671
> >
> >Log:
> >Add packet->len checks to avoid out-of-bounds reads and negative
> >es->size values.
> >
> >Modified:
> >    trunk/libmpdemux/demux_ts.c
> 
> *blush*
> I should have though ot it myself. Anyway, did you incur in such a
> broken sample? At that level it should quite
> hard triggering a case like that.

Well, the PGS "display now" code has only 3 bytes and starts
with 0x80. So on my first try it ran right into the
"A52 WITH HEADER" case and I got a -1 as size...