diff mbox series

[FFmpeg-devel] Fixes overflow in libavformat/mpegts.c when parsing the PMT, ticket #9422.

Message ID 20210914183227.9924-1-nicolas.dato@gmail.com
State New
Headers show
Series [FFmpeg-devel] Fixes overflow in libavformat/mpegts.c when parsing the PMT, ticket #9422. | expand

Checks

Context Check Description
andriy/commit_msg_x86 warning The first line of the commit message must start with a context terminated by a colon and a space, for example "lavu/opt: " or "doc: ".
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/commit_msg_ppc warning The first line of the commit message must start with a context terminated by a colon and a space, for example "lavu/opt: " or "doc: ".
andriy/make_ppc success Make finished
andriy/make_fate_ppc success Make fate finished

Commit Message

Nicolas Jorge Dato Sept. 14, 2021, 6:32 p.m. UTC 
When an possible overflow was detected, there was a break to exit the while loop.
However, it should have already substracted 2 bytes from program_info_length (descri^Cor ID + length).
---
 libavformat/mpegts.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index fe89d4fb9f..f4e95d21fd 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -2346,10 +2346,11 @@  static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
 
         av_log(ts->stream, AV_LOG_TRACE, "program tag: 0x%02x len=%d\n", tag, len);
 
-        if (len > program_info_length - 2)
+        program_info_length -= 2;
+        if (len > program_info_length)
             // something else is broken, exit the program_descriptors_loop
             break;
-        program_info_length -= len + 2;
+        program_info_length -= len;
         if (tag == IOD_DESCRIPTOR) {
             get8(&p, p_end); // scope
             get8(&p, p_end); // label