mpegtsdemux: fix possible read beyond end of buffer when resyncing

This commit is contained in:
Tim-Philipp Müller 2013-08-27 17:05:44 +01:00
parent 4b10f278b6
commit cf791f6cb0

View file

@ -800,7 +800,7 @@ mpegts_packetizer_next_packet (MpegTSPacketizer2 * packetizer,
GST_LOG ("Lost sync %d", packet_size);
/* Find the 0x47 in the buffer (and require at least 2 checks) */
for (; sync_offset < priv->mapped_size + 2 * packet_size; sync_offset++)
for (; sync_offset + 2 * packet_size < priv->mapped_size; sync_offset++)
if (priv->mapped[sync_offset] == 0x47 &&
priv->mapped[sync_offset + packet_size] == 0x47 &&
priv->mapped[sync_offset + 2 * packet_size] == 0x47)