ps demux: fix an issue in ps_pkt_read()

modules/demux/ps.c

@@ -559,10 +559,15 @@ static block_t *ps_pkt_read( stream_t *s, uint32_t i_code )
 {
     const uint8_t *p_peek;
     int      i_peek = stream_Peek( s, &p_peek, 14 );
-    int      i_size = ps_pkt_size( p_peek, i_peek );
+    int      i_size;
     VLC_UNUSED(i_code);
 
-    if( i_size <= 6 && p_peek[3] > 0xba )
+    /* Smallest valid packet */
+    if( i_peek < 6 ) return NULL;
+
+    i_size = ps_pkt_size( p_peek, i_peek );
+
+    if( i_size < 0 || ( i_size <= 6 && p_peek[3] > 0xba ) )
     {
         /* Special case, search the next start code */
         i_size = 6;

modules/demux/ps.h

@@ -22,6 +22,7 @@
  *****************************************************************************/
 
 #include <vlc_demux.h>
+#include <assert.h>
 
 /* 256-0xC0 for normal stream, 256 for 0xbd stream, 256 for 0xfd stream */
 #define PS_TK_COUNT (768 - 0xc0)
@@ -246,10 +247,11 @@ static inline int ps_pkt_id( block_t *p_pkt )
 }
 
 /* return the size of the next packet
- * XXX you need to give him at least 14 bytes (and it need to start as a
- * valid packet) */
+ * You need to give him at least 14 bytes (and it need to start as a
+ * valid packet) It does not handle less than 6 bytes */
 static inline int ps_pkt_size( const uint8_t *p, int i_peek )
 {
+    assert( i_peek >= 6 );
     if( p[3] == 0xb9 && i_peek >= 4 )
     {
         return 4;