Skip to content

V
vlc-1.1
Commit 26d92b87 authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont
Browse files
Options

Fix (yet another) TiVo demux overflow. 

Reported by Tobias Klein <tk@trapkit.de>
parent 2132eade
Show whitespace changes
Inline Side-by-side
Showing with 3 additions and 1 deletion
modules/demux/ty.c
View file @ 26d92b87
...@@ -1639,12 +1639,14 @@ static void parse_master(demux_t *p_demux) ...@@ -1639,12 +1639,14 @@ static void parse_master(demux_t *p_demux)
/* parse all the entries */ /* parse all the entries */
p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t)); p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t));
for (i=0; i<p_sys->i_seq_table_size; i++) { for (i=0; i<p_sys->i_seq_table_size; i++) {
stream_Read(p_demux->s, mst_buf, 8 + i_map_size); stream_Read(p_demux->s, mst_buf, 8);
p_sys->seq_table[i].l_timestamp = U64_AT(&mst_buf[0]); p_sys->seq_table[i].l_timestamp = U64_AT(&mst_buf[0]);
if (i_map_size > 8) { if (i_map_size > 8) {
msg_Err(p_demux, "Unsupported SEQ bitmap size in master chunk"); msg_Err(p_demux, "Unsupported SEQ bitmap size in master chunk");
stream_Read(p_demux->s, NULL, i_map_size);
memset(p_sys->seq_table[i].chunk_bitmask, i_map_size, 0); memset(p_sys->seq_table[i].chunk_bitmask, i_map_size, 0);
} else { } else {
stream_Read(p_demux->s, mst_buf + 8, i_map_size);
memcpy(p_sys->seq_table[i].chunk_bitmask, &mst_buf[8], i_map_size); memcpy(p_sys->seq_table[i].chunk_bitmask, &mst_buf[8], i_map_size);
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment