From 336710d355c598cedb126b318680b44ab082b24e Mon Sep 17 00:00:00 2001
From: Thibault Saunier <thibault.saunier@collabora.com>
Date: Fri, 24 Feb 2012 19:08:40 -0300
Subject: [PATCH] tsbase: Fix parsing of PSI table IDs

(Ported from mpegtsdemux d8fd874f5290e4911437120057ee885cdb68b4af)
---
 gst/mpegtsdemux/mpegtsbase.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/gst/mpegtsdemux/mpegtsbase.c b/gst/mpegtsdemux/mpegtsbase.c
index 193e84ac70..853eb9ff88 100644
--- a/gst/mpegtsdemux/mpegtsbase.c
+++ b/gst/mpegtsdemux/mpegtsbase.c
@@ -680,7 +680,7 @@ gboolean
 mpegts_base_is_psi (MpegTSBase * base, MpegTSPacketizerPacket * packet)
 {
   gboolean retval = FALSE;
-  guint8 table_id;
+  guint8 *data, table_id, pointer;
   int i;
   static const guint8 si_tables[] =
       { 0x00, 0x01, 0x02, 0x03, 0x40, 0x41, 0x42, 0x46, 0x4A,
@@ -699,6 +699,18 @@ mpegts_base_is_psi (MpegTSBase * base, MpegTSPacketizerPacket * packet)
 
   if (!retval) {
     if (packet->payload_unit_start_indicator) {
+      data = packet->data;
+      pointer = *data++;
+      data += pointer;
+      /* 'pointer' value may be invalid on malformed packet
+       * so we need to avoid out of range
+       */
+      if (!(data < packet->data_end)) {
+        GST_WARNING_OBJECT (base,
+            "Wrong offset when retrieving table id: 0x%x", pointer);
+        return FALSE;
+      }
+
       table_id = *(packet->data);
       i = 0;
       while (si_tables[i] != TABLE_ID_UNSET) {