From 224da2b9476a4a6269ce0d4a5594de7c1837b244 Mon Sep 17 00:00:00 2001 From: Ben Butterworth <24711048+ben-xD@users.noreply.github.com> Date: Thu, 20 Feb 2025 21:59:31 +0000 Subject: [PATCH] mpegts: handle MPEG2-TS with KLV metadata safely by preventing out of bounds Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3896 @slomo, as requested on https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3896#note_2780065 Part-of: --- subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c b/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c index 0b7d8e3976..39910eaf25 100644 --- a/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c +++ b/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c @@ -3557,8 +3557,11 @@ parse_pes_metadata_frame (TSDemuxStream * stream) if (!gst_byte_reader_get_uint16_be (&reader, &au_size)) goto error; - if (gst_byte_reader_get_remaining (&reader) < au_size) - goto error; + guint rem = gst_byte_reader_get_remaining (&reader); + + if (rem < au_size) { + au_size = rem; + } if (!gst_byte_reader_dup_data (&reader, au_size, &au_data)) goto error;