[vlc-commits] demux: ts: fix oob read

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Nov 17 14:24:33 2017 +0100| [fca9a302adb45595e91725b5fa04c501d90b604e] | committer: Francois Cartegnie

demux: ts: fix oob read

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=fca9a302adb45595e91725b5fa04c501d90b604e
---

 modules/demux/mpeg/ts.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/demux/mpeg/ts.c b/modules/demux/mpeg/ts.c
index 4d69261b16..b835753b81 100644
--- a/modules/demux/mpeg/ts.c
+++ b/modules/demux/mpeg/ts.c
@@ -1925,7 +1925,7 @@ static int SeekToTime( demux_t *p_demux, const ts_pmt_t *p_pmt, int64_t i_scaled
                     if( p_pkt->i_buffer >= 4 + 2 + 5 )
                     {
                         i_pcr = GetPCR( p_pkt );
-                        i_skip += 1 + p_pkt->p_buffer[4];
+                        i_skip += 1 + __MIN(p_pkt->p_buffer[4], 182);
                     }
                 }
                 else
@@ -2020,7 +2020,7 @@ static int ProbeChunk( demux_t *p_demux, int i_program, bool b_end, int64_t *pi_
                 uint8_t i_stream_id;
                 unsigned i_skip = 4;
                 if ( b_adaptfield ) // adaptation field
-                    i_skip += 1 + p_pkt->p_buffer[4];
+                    i_skip += 1 + __MIN(p_pkt->p_buffer[4], 182);
 
                 if ( VLC_SUCCESS == ParsePESHeader( VLC_OBJECT(p_demux), &p_pkt->p_buffer[i_skip],
                                                     p_pkt->i_buffer - i_skip, &i_skip,