[vlc-commits] demux: ts: fix peek use after free

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Nov 17 13:51:57 2017 +0100| [c618453309ed65611619272178621f5eb62a2822] | committer: Francois Cartegnie

demux: ts: fix peek use after free

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=c618453309ed65611619272178621f5eb62a2822
---

 modules/demux/mpeg/ts.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mpeg/ts.c b/modules/demux/mpeg/ts.c
index 431e7b98c7..4d69261b16 100644
--- a/modules/demux/mpeg/ts.c
+++ b/modules/demux/mpeg/ts.c
@@ -262,6 +262,7 @@ static int DetectPVRHeadersAndHeaderSize( demux_t *p_demux, unsigned *pi_header_
         vlc_stream_Peek( p_demux->s, &p_peek, TOPFIELD_HEADER_SIZE + TS_PACKET_SIZE_MAX )
             == TOPFIELD_HEADER_SIZE + TS_PACKET_SIZE_MAX )
     {
+        const int i_service = GetWBE(&p_peek[18]);
         i_packet_size = DetectPacketSize( p_demux, pi_header_size, TOPFIELD_HEADER_SIZE );
         if( i_packet_size != -1 )
         {
@@ -329,7 +330,7 @@ static int DetectPVRHeadersAndHeaderSize( demux_t *p_demux, unsigned *pi_header_
             msg_Dbg( p_demux, "extended event text=%s", psz_ext_text );
             // 52 bytes reserved Bslbf
 #endif
-            p_vdr->i_service = GetWBE(&p_peek[18]);
+            p_vdr->i_service = i_service;
 
             return i_packet_size;
             //return TS_PACKET_SIZE_188;