diff options
| author | Marton Balint <cus@passwd.hu> | 2021-09-21 22:30:55 +0200 |
|---|---|---|
| committer | Marton Balint <cus@passwd.hu> | 2021-10-10 16:54:15 +0200 |
| commit | 9420f7e09560d82ebdb96ddc6724a734f4fe0b95 (patch) | |
| tree | 7efe02e0f5027bd194b44579199800fc28b64a6b /libavformat/mpegts.c | |
| parent | aeea2ad0e4501a05ac4ada0c9b88e116135439eb (diff) | |
avformat/mpegts: fix max_packet_size in mpegts payload parsing
The maximum allowed useful PES payload data was set to PES_packet_length, but
it is in fact smaller by the length of the PES header.
This changes how corrupt streams are packetized:
- If PES header length is bigger than PES_packet_length then the PES packet
payload will be handled as an unbound packet
- PES packets with payload across multiple MPEGTS packets will always be
splitted if with the next chunk of data the payload should exceed
PES_packet_length, previously a PES_header_length amount of excess was
allowed.
Fixes ticket #9355.
Signed-off-by: Marton Balint <cus@passwd.hu>
Diffstat (limited to 'libavformat/mpegts.c')
| -rw-r--r-- | libavformat/mpegts.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index d4f5355d97..9a6bbb1c93 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1358,8 +1358,8 @@ skip: case MPEGTS_PAYLOAD: do { int max_packet_size = MAX_PES_PAYLOAD; - if (pes->PES_packet_length) - max_packet_size = pes->PES_packet_length; + if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size) + max_packet_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size; if (pes->data_index > 0 && pes->data_index + buf_size > max_packet_size) { |