From 70d83b323bcbc956e19d050e145a410f46b84e1a Mon Sep 17 00:00:00 2001 From: Edward Hervey Date: Fri, 11 Oct 2013 10:32:52 +0200 Subject: [PATCH] mpegtspacketizer: Skip packets with corrupted length This is similar to what we do for packets with payload --- gst/mpegtsdemux/mpegtspacketizer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/gst/mpegtsdemux/mpegtspacketizer.c b/gst/mpegtsdemux/mpegtspacketizer.c index 49a36eb161..b11a964440 100644 --- a/gst/mpegtsdemux/mpegtspacketizer.c +++ b/gst/mpegtsdemux/mpegtspacketizer.c @@ -315,6 +315,11 @@ mpegts_packetizer_parse_adaptation_field_control (MpegTSPacketizer2 * if ((packet->scram_afc_cc & 0x30) == 0x20) { /* no payload, adaptation field of 183 bytes */ + if (length > 183) { + GST_WARNING ("PID %d afc == 0x%02x and length %d > 183", + packet->pid, packet->scram_afc_cc & 0x30, length); + return FALSE; + } if (length != 183) { GST_WARNING ("PID %d afc == 0x%02x and length %d != 183", packet->pid, packet->scram_afc_cc & 0x30, length);