mpegtsdemux: fix possible read beyond end of buffer when resyncing
This commit is contained in:
parent
4b10f278b6
commit
cf791f6cb0
@ -800,7 +800,7 @@ mpegts_packetizer_next_packet (MpegTSPacketizer2 * packetizer,
|
|||||||
GST_LOG ("Lost sync %d", packet_size);
|
GST_LOG ("Lost sync %d", packet_size);
|
||||||
|
|
||||||
/* Find the 0x47 in the buffer (and require at least 2 checks) */
|
/* Find the 0x47 in the buffer (and require at least 2 checks) */
|
||||||
for (; sync_offset < priv->mapped_size + 2 * packet_size; sync_offset++)
|
for (; sync_offset + 2 * packet_size < priv->mapped_size; sync_offset++)
|
||||||
if (priv->mapped[sync_offset] == 0x47 &&
|
if (priv->mapped[sync_offset] == 0x47 &&
|
||||||
priv->mapped[sync_offset + packet_size] == 0x47 &&
|
priv->mapped[sync_offset + packet_size] == 0x47 &&
|
||||||
priv->mapped[sync_offset + 2 * packet_size] == 0x47)
|
priv->mapped[sync_offset + 2 * packet_size] == 0x47)
|
||||||
|
Loading…
x
Reference in New Issue
Block a user