[MPlayer-cvslog] r31671 - trunk/libmpdemux/demux_ts.c
Reimar.Doeffinger at gmx.de
Sat Jul 10 23:50:25 CEST 2010
On Sat, Jul 10, 2010 at 11:36:25PM +0200, Nico Sabbi wrote:
> reimar ha scritto:
> >Author: reimar
> >Date: Sat Jul 10 18:48:59 2010
> >New Revision: 31671
> >Add packet->len checks to avoid out-of-bounds reads and negative
> >es->size values.
> > trunk/libmpdemux/demux_ts.c
> I should have though ot it myself. Anyway, did you incur in such a
> broken sample? At that level it should quite
> hard triggering a case like that.
Well, the PGS "display now" code has only 3 bytes and starts
with 0x80. So on my first try it ran right into the
"A52 WITH HEADER" case and I got a -1 as size...
More information about the MPlayer-cvslog