Fix potential static array overflow (CID 40 and 192)

diff --git a/modules/demux/ps.h b/modules/demux/ps.h
index 2b415411606c1fa5fb0baf521f65711890cfadc1..a15daad3cc010dfd970734c5fa79fb746191598d 100644 (file)
--- a/modules/demux/ps.h
+++ b/modules/demux/ps.h
@@ -344,10 +344,10 @@ static inline int ps_pkt_parse_system( block_t *p_pkt, ps_psm_t *p_psm,
 /* Parse a PES (and skip i_skip_extra in the payload) */
 static inline int ps_pkt_parse_pes( block_t *p_pes, int i_skip_extra )
 {
-    uint8_t header[30];
+    uint8_t header[34];
     unsigned int i_skip  = 0;
 
-    memcpy( header, p_pes->p_buffer, __MIN( p_pes->i_buffer, 30 ) );
+    memcpy( header, p_pes->p_buffer, __MIN( p_pes->i_buffer, 34 ) );
 
     switch( header[3] )
     {

diff --git a/modules/demux/ts.c b/modules/demux/ts.c
index 57d9198073761b5534b8561b0672e4b987440f59..862ccd6f39d4603e2c11da5ec5fd01072eee5716 100644 (file)
--- a/modules/demux/ts.c
+++ b/modules/demux/ts.c
@@ -1664,7 +1664,7 @@ static void PIDClean( es_out_t *out, ts_pid_t *pid )
 static void ParsePES( demux_t *p_demux, ts_pid_t *pid )
 {
     block_t *p_pes = pid->es->p_pes;
-    uint8_t header[30];
+    uint8_t header[34];
     int     i_pes_size = 0;
     int     i_skip = 0;
     mtime_t i_dts = -1;
@@ -1679,7 +1679,7 @@ static void ParsePES( demux_t *p_demux, ts_pid_t *pid )
     pid->es->pp_last = &pid->es->p_pes;
 
     /* FIXME find real max size */
-    i_max = block_ChainExtract( p_pes, header, 30 );
+    i_max = block_ChainExtract( p_pes, header, 34 );
 
 
     if( header[0] != 0 || header[1] != 0 || header[2] != 1 )