diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-03-02 10:13:07 -0800 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-03-02 15:44:42 -0800 |
| commit | 1aa708988ac131cf7d5c8bd59aca256a7c974df9 (patch) | |
| tree | 2e005445f61bfce5bc8bfbb2cc16c532e3a16e16 /libavformat/mpegts.c | |
| parent | 4df369692ea8aee7094ac0f233cef8d1bee139a3 (diff) | |
mpegts: Pad the packet buffer in handle_packet().
This allows it to be used with get_bits without the thread of overreads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavformat/mpegts.c')
| -rw-r--r-- | libavformat/mpegts.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 32901a1919..fb0c416b3b 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1772,7 +1772,7 @@ static int read_packet(AVFormatContext *s, uint8_t *buf, int raw_packet_size) static int handle_packets(MpegTSContext *ts, int nb_packets) { AVFormatContext *s = ts->stream; - uint8_t packet[TS_PACKET_SIZE]; + uint8_t packet[TS_PACKET_SIZE+FF_INPUT_BUFFER_PADDING_SIZE]; int packet_num, ret = 0; if (avio_tell(s->pb) != ts->last_pos) { @@ -1794,6 +1794,7 @@ static int handle_packets(MpegTSContext *ts, int nb_packets) ts->stop_parse = 0; packet_num = 0; + memset(packet + TS_PACKET_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE); for(;;) { if (ts->stop_parse>0) break; |