[vlc-devel] commit: ps demux: fix an issue in ps_pkt_read() (Derk-Jan Hartman )

[git version control]

vlc | branch: 0.9-bugfix | Derk-Jan Hartman <hartman at videolan.org> | Mon Sep 15 23:19:38 2008 +0200| [deedaf8267f7a9c02cbc9aa728a68e5156eabb4c] | committer: Derk-Jan Hartman 

ps demux: fix an issue in ps_pkt_read()
(cherry picked from commit d761cf6f1d40a952548407b843ee0c3f0a3cd472)

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=deedaf8267f7a9c02cbc9aa728a68e5156eabb4c
---

 modules/demux/ps.c |    9 +++++++--
 modules/demux/ps.h |    6 ++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/demux/ps.c b/modules/demux/ps.c
index bed63fe..1a6adab 100644
--- a/modules/demux/ps.c
+++ b/modules/demux/ps.c
@@ -559,10 +559,15 @@ static block_t *ps_pkt_read( stream_t *s, uint32_t i_code )
 {
     const uint8_t *p_peek;
     int      i_peek = stream_Peek( s, &p_peek, 14 );
-    int      i_size = ps_pkt_size( p_peek, i_peek );
+    int      i_size;
     VLC_UNUSED(i_code);
 
-    if( i_size <= 6 && p_peek[3] > 0xba )
+    /* Smallest valid packet */
+    if( i_peek < 6 ) return NULL;
+
+    i_size = ps_pkt_size( p_peek, i_peek );
+
+    if( i_size < 0 || ( i_size <= 6 && p_peek[3] > 0xba ) )
     {
         /* Special case, search the next start code */
         i_size = 6;
diff --git a/modules/demux/ps.h b/modules/demux/ps.h
index 145880d..2b41541 100644
--- a/modules/demux/ps.h
+++ b/modules/demux/ps.h
@@ -22,6 +22,7 @@
  *****************************************************************************/
 
 #include <vlc_demux.h>
+#include <assert.h>
 
 /* 256-0xC0 for normal stream, 256 for 0xbd stream, 256 for 0xfd stream */
 #define PS_TK_COUNT (768 - 0xc0)
@@ -246,10 +247,11 @@ static inline int ps_pkt_id( block_t *p_pkt )
 }
 
 /* return the size of the next packet
- * XXX you need to give him at least 14 bytes (and it need to start as a
- * valid packet) */
+ * You need to give him at least 14 bytes (and it need to start as a
+ * valid packet) It does not handle less than 6 bytes */
 static inline int ps_pkt_size( const uint8_t *p, int i_peek )
 {
+    assert( i_peek >= 6 );
     if( p[3] == 0xb9 && i_peek >= 4 )
     {
         return 4;