mpegtsparse: check offset when retrieving table_id on malformed packets

Fix bug #665988
This commit is contained in:
Julien Isorce 2011-12-12 15:52:20 +01:00 committed by Sebastian Dröge
parent 0d40afa9f0
commit f21ea162ad

View file

@ -895,6 +895,14 @@ mpegts_parse_is_psi (MpegTSParse * parse, MpegTSPacketizerPacket * packet)
data = packet->data; data = packet->data;
pointer = *data++; pointer = *data++;
data += pointer; data += pointer;
/* 'pointer' value may be invalid on malformed packet
* so we need to avoid out of range
*/
if (!(data < packet->data_end)) {
GST_WARNING_OBJECT (parse,
"Wrong offset when retrieving table id: 0x%x", pointer);
return FALSE;
}
table_id = *data; table_id = *data;
i = 0; i = 0;
while (si_tables[i] != TABLE_ID_UNSET) { while (si_tables[i] != TABLE_ID_UNSET) {