diff options
| author | Tim-Philipp Müller <tim@centricular.net> | 2013-08-27 17:05:44 +0100 |
|---|---|---|
| committer | Tim-Philipp Müller <tim@centricular.net> | 2013-08-27 17:05:44 +0100 |
| commit | cf791f6cb011959bcfdc72762d31f4a1b9dc07d2 (patch) | |
| tree | 1bcdeadefdb0db96fb9c8c7ef9aecc65345cea41 | |
| parent | 4b10f278b6268b01d16052257d5da7c9ba985f03 (diff) | |
| download | gstreamer-plugins-bad-cf791f6cb011959bcfdc72762d31f4a1b9dc07d2.tar.gz | |
mpegtsdemux: fix possible read beyond end of buffer when resyncing
| -rw-r--r-- | gst/mpegtsdemux/mpegtspacketizer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/gst/mpegtsdemux/mpegtspacketizer.c b/gst/mpegtsdemux/mpegtspacketizer.c index 6f21bb5a5..a64fd005c 100644 --- a/gst/mpegtsdemux/mpegtspacketizer.c +++ b/gst/mpegtsdemux/mpegtspacketizer.c @@ -800,7 +800,7 @@ mpegts_packetizer_next_packet (MpegTSPacketizer2 * packetizer, GST_LOG ("Lost sync %d", packet_size); /* Find the 0x47 in the buffer (and require at least 2 checks) */ - for (; sync_offset < priv->mapped_size + 2 * packet_size; sync_offset++) + for (; sync_offset + 2 * packet_size < priv->mapped_size; sync_offset++) if (priv->mapped[sync_offset] == 0x47 && priv->mapped[sync_offset + packet_size] == 0x47 && priv->mapped[sync_offset + 2 * packet_size] == 0x47) |