* mpeg/psi.h: Fix an infinite loop when receiving an invalid section.

b34ea7f0 · Christophe Massiot · 8154e00f · b34ea7f0
Commit b34ea7f0 authored Aug 15, 2010 by Christophe Massiot
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 0 deletions

mpeg/psi.h mpeg/psi.h +5 -0

No files found.
--- a/mpeg/psi.h
+++ b/mpeg/psi.h
@@ -539,6 +539,11 @@ static inline uint8_t *psi_assemble_payload(uint8_t **pp_psi_buffer,
        uint16_t i_section_size = psi_get_length(*pp_psi_buffer)
                                   + PSI_HEADER_SIZE;
+        if (i_section_size > PSI_PRIVATE_MAX_SIZE) {
+            /* invalid section */
+            psi_assemble_reset(pp_psi_buffer, pi_psi_buffer_used);
+            return NULL;
+        }
        if (i_section_size <= *pi_psi_buffer_used) {
            p_section = *pp_psi_buffer;
            i_copy_size -= (*pi_psi_buffer_used - i_section_size);