summaryrefslogtreecommitdiff
path: root/gst-libs/gst/mpegts
diff options
context:
space:
mode:
authorVincent Penquerc'h <vincent.penquerch@collabora.co.uk>2017-04-07 10:43:51 +0100
committerSebastian Dröge <sebastian@centricular.com>2017-04-09 11:16:37 +0300
commit9eab67a4af6183a2305cb23beeb0e6b78e9c3e21 (patch)
treeb90ca49353ec059f0a886c8a41d29d0c9cd71c3c /gst-libs/gst/mpegts
parenta3a12d097893c1d3b650c2de0a363a63d08ad866 (diff)
downloadgstreamer-plugins-bad-9eab67a4af6183a2305cb23beeb0e6b78e9c3e21.tar.gz
mpegts: fix invalid memory access in language descriptor
Also add a couple sanity asserts/returns https://bugzilla.gnome.org/show_bug.cgi?id=781024
Diffstat (limited to 'gst-libs/gst/mpegts')
-rw-r--r--gst-libs/gst/mpegts/gstmpegtsdescriptor.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/gst-libs/gst/mpegts/gstmpegtsdescriptor.c b/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
index a49ce2a2c..079716e7f 100644
--- a/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
+++ b/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
@@ -855,6 +855,7 @@ gst_mpegts_descriptor_from_registration (const gchar * format_identifier,
GstMpegtsDescriptor *descriptor;
g_return_val_if_fail (format_identifier != NULL, NULL);
+ g_return_val_if_fail (additional_info_length > 0 || !additional_info, NULL);
descriptor = _new_descriptor (GST_MTS_DESC_REGISTRATION,
4 + additional_info_length);
@@ -1055,7 +1056,7 @@ gst_mpegts_descriptor_from_iso_639_language (const gchar * language)
g_return_val_if_fail (language != NULL, NULL);
- descriptor = _new_descriptor (GST_MTS_DESC_ISO_639_LANGUAGE, 4 + 4); /* a language takes 4 bytes */
+ descriptor = _new_descriptor (GST_MTS_DESC_ISO_639_LANGUAGE, 4); /* a language takes 4 bytes */
memcpy (descriptor->data + 2, language, 3);
descriptor->data[2 + 3] = 0; /* set audio type to undefined */
@@ -1116,6 +1117,8 @@ gst_mpegts_descriptor_from_custom (guint8 tag, const guint8 * data,
{
GstMpegtsDescriptor *descriptor;
+ g_return_val_if_fail (length > 0 || !data, NULL);
+
descriptor = _new_descriptor (tag, length);
if (data && (length > 0))