[vlc-commits] commit: dvdnav: ps_pkt_size() requires at least 6 bytes (fixes #4015) ( Rémi Denis-Courmont )

[git at videolan.org]

vlc/vlc-1.1 | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Sun Aug  8 18:50:47 2010 +0300| [96f3254918b9e6db898e31d8817c83d1fdd1a274] | committer: Rémi Denis-Courmont 

dvdnav: ps_pkt_size() requires at least 6 bytes (fixes #4015)

The same check is already done in the dvdread, ps and vobsub modules.
(cherry picked from commit 8a497301054ccc2d9d470ade60264036d43e3fc0)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-1.1.git/?a=commit;h=96f3254918b9e6db898e31d8817c83d1fdd1a274
---

 modules/access/dvdnav.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/access/dvdnav.c b/modules/access/dvdnav.c
index 90d9155..80b5b94 100644
--- a/modules/access/dvdnav.c
+++ b/modules/access/dvdnav.c
@@ -1130,17 +1130,17 @@ static int DemuxBlock( demux_t *p_demux, const uint8_t *pkt, int i_pkt )
     demux_sys_t *p_sys = p_demux->p_sys;
     const uint8_t     *p = pkt;
 
-    while( p < &pkt[i_pkt] )
+    while( (p - pkt) <= (i_pkt - 6) )
     {
+        /* ps_pkt_size() needs at least 6 bytes */
         int i_size = ps_pkt_size( p, &pkt[i_pkt] - p );
-        block_t *p_pkt;
         if( i_size <= 0 )
         {
             break;
         }
 
         /* Create a block */
-        p_pkt = block_New( p_demux, i_size );
+        block_t *p_pkt = block_New( p_demux, i_size );
         memcpy( p_pkt->p_buffer, p, i_size);
 
         /* Parse it and send it */