diff --git a/gst-libs/gst/mpegts/gstmpegtssection.c b/gst-libs/gst/mpegts/gstmpegtssection.c index cc5e21b2ad..02038a76a0 100644 --- a/gst-libs/gst/mpegts/gstmpegtssection.c +++ b/gst-libs/gst/mpegts/gstmpegtssection.c @@ -715,6 +715,11 @@ _parse_pmt (GstMpegtsSection * section) i += 1; } + /* Section length was longer than the actual content of the PMT */ + if (data <= end - 4) + goto error; + + /* Ensure we did not read after the end of our array */ g_assert (data == end - 4); return (gpointer) pmt;