vlc | branch: master | Francois Cartegnie <[email protected]> | Fri Mar 10 16:19:06 2017 +0100| [344a3f20f12d2cbe010eeb8cc96b0815862f237e] | committer: Francois Cartegnie
demux: ps: fix potential oob read > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=344a3f20f12d2cbe010eeb8cc96b0815862f237e --- modules/demux/mpeg/ps.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/modules/demux/mpeg/ps.h b/modules/demux/mpeg/ps.h index 732c1e6..f177967 100644 --- a/modules/demux/mpeg/ps.h +++ b/modules/demux/mpeg/ps.h @@ -109,13 +109,16 @@ static inline int ps_track_fill( ps_track_t *tk, ps_psm_t *p_psm, int i_id, bloc if( ( i_id&0xf0 ) == 0xc0 && p_pkt && p_pkt->i_buffer > 8 ) { unsigned i_start = 9 + p_pkt->p_buffer[8]; - /* AC-3 marking, see vlc_a52_header_Parse */ - if( p_pkt->p_buffer[i_start + 4] == 0x0b || - p_pkt->p_buffer[i_start + 5] == 0x77 ) + if( i_start + 9 < p_pkt->i_buffer ) { - int bsid = p_pkt->p_buffer[i_start + 9] >> 3; - if( bsid > 10 ) - b_eac3 = true; + /* AC-3 marking, see vlc_a52_header_Parse */ + if( p_pkt->p_buffer[i_start + 4] == 0x0b || + p_pkt->p_buffer[i_start + 5] == 0x77 ) + { + int bsid = p_pkt->p_buffer[i_start + 9] >> 3; + if( bsid > 10 ) + b_eac3 = true; + } } } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
