[vlc-devel] Errors in TS Packet Validation [1/1]

[Andy Lindsay]

I am using VLC to handle DVB-T streams in an area of poor reception 
which leads to VLC receiving corrupted TS packets.  From this I have 
identified some errors in the way that TS & PES packets are validated:

1.  In function DemuxTS(), the adaptation field value is added to 
p_payload_start before it is validated.  If it is invalid then 
b_discard_payload is set but p_payload_start is left corrupted and 
greater than p_payload_end.  This results in GetChunk() trying to copy 
vast amounts of data which results in a crash.

2.  Also in function DemuxTS(), the checks on the continuity counter 
don't cater for all the cases of a packet with no payload.

3.  In function GatherPES(), if the PES packet length is zero, then 
i_pes_real_size is set to 6.  This is wrong, it should be zero.

4.  Also in the function GatherPES(), the code should pass the packet to 
ParsePES() if the length is greater than the expected size.

I have also identified another point, but I'm not sure if this is an 
error or not: in DemuxTS(), if a packet has the discontinuity_indicator 
set then the continuity counter is reset so that the packet is accepted 
in the continuity checks below.  Should the counter be left so that the 
code below can validate the counter and handle or trash the packet as 
appropriate?

The attached patch corrects all these points (including the one I'm not 
sure about) and also tidies up some of the debug messages in these 
functions.

-- 
Andy Lindsay

-------------- next part --------------
A non-text attachment was scrubbed...
Name: system.c.patch
Type: application/octet-stream
Size: 6948 bytes
Desc: system.c.patch
URL: <http://mailman.videolan.org/pipermail/vlc-devel/attachments/20030401/7c91c89e/attachment.obj>