[vlc-devel] commit: Fix (yet another) TiVo demux overflow. ( Rémi Denis-Courmont )

[git version control]

vlc | branch: master | Rémi Denis-Courmont <rdenis at simphalempin.com> | Sat Oct 18 22:19:49 2008 +0300| [26d92b87bba99b5ea2e17b7eaa39c462d65e9133] | committer: Rémi Denis-Courmont 

Fix (yet another) TiVo demux overflow.

Reported by Tobias Klein <tk at trapkit.de>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=26d92b87bba99b5ea2e17b7eaa39c462d65e9133
---

 modules/demux/ty.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/modules/demux/ty.c b/modules/demux/ty.c
index 754e235..65a408f 100644
--- a/modules/demux/ty.c
+++ b/modules/demux/ty.c
@@ -1639,12 +1639,14 @@ static void parse_master(demux_t *p_demux)
     /* parse all the entries */
     p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t));
     for (i=0; i<p_sys->i_seq_table_size; i++) {
-        stream_Read(p_demux->s, mst_buf, 8 + i_map_size);
+        stream_Read(p_demux->s, mst_buf, 8);
         p_sys->seq_table[i].l_timestamp = U64_AT(&mst_buf[0]);
         if (i_map_size > 8) {
             msg_Err(p_demux, "Unsupported SEQ bitmap size in master chunk");
+            stream_Read(p_demux->s, NULL, i_map_size);
             memset(p_sys->seq_table[i].chunk_bitmask, i_map_size, 0);
         } else {
+            stream_Read(p_demux->s, mst_buf + 8, i_map_size);
             memcpy(p_sys->seq_table[i].chunk_bitmask, &mst_buf[8], i_map_size);
         }
     }