Mailing List Archive

[MythTV/mythtv] 2b0cfb: Check adaptation field size when skipping adaptati...
Branch: refs/heads/master
Home: https://github.com/MythTV/mythtv
Commit: 2b0cfba827fa889f907f7a8cf0175fe360aae7a0
https://github.com/MythTV/mythtv/commit/2b0cfba827fa889f907f7a8cf0175fe360aae7a0
Author: Klaas de Waal <kdewaal@mythtv.org>
Date: 2020-12-25 (Fri, 25 Dec 2020)

Changed paths:
M mythtv/libs/libmythtv/mpeg/pespacket.cpp

Log Message:
-----------
Check adaptation field size when skipping adaptation field data

When copying the PES/PSI data from TS packets the adaptation fields are skipped, as
indicated by the value of the adaptation field control and the adaptation field size.
When the complete TS packet payload of 184 bytes is used for the adaptation field
the adaptation field size is 183 bytes; one byte is used for the adaptation field size.
When there are errors in the input stream, as can be caused by bad reception conditions
or by faulty equipment, the adaptation field size as received can have any value
up to 255. Any value higher than 183 leads to reading beyond the end of the incoming
TS packet and, even worse, leads to an attempt to copy close to UINT_MAX bytes.
This then causes a segmentation fault and termination of the backend.
Fixed by limiting the number of bytes to skip to the TS packet payload size of 184.


_______________________________________________
mythtv-commits mailing list
mythtv-commits@mythtv.org
http://lists.mythtv.org/mailman/listinfo/mythtv-commits