From 7fe08e057cddfc4883e481bb7d2de8a7eec25865 Mon Sep 17 00:00:00 2001
From: Doug Nazar <nazard@nazar.ca>
Date: Wed, 21 May 2025 10:10:25 -0400
Subject: [PATCH] tsdemux: Ensure AC3 descriptor is long enough before
 accessing

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9044>
---
 subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c b/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c
index a88f35efd4..26383a6c68 100644
--- a/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c
+++ b/subprojects/gst-plugins-bad/gst/mpegtsdemux/tsdemux.c
@@ -1256,7 +1256,8 @@ gst_ts_demux_create_tags (TSDemuxStream * stream)
     const GstMpegtsDescriptor *ac3_desc =
         mpegts_get_descriptor_from_stream (bstream,
         GST_MTS_DESC_AC3_AUDIO_STREAM);
-    if (ac3_desc && DESC_AC_AUDIO_STREAM_has_lang1 (ac3_desc->data)) {
+    if (ac3_desc && ac3_desc->length >= 8
+        && DESC_AC_AUDIO_STREAM_has_lang1 (ac3_desc->data)) {
       gchar lang_code[4];
 
       memcpy (lang_code, DESC_AC_AUDIO_STREAM_lang1_code (ac3_desc->data), 3);