ps demux: fix an issue in ps_pkt_read()

diff --git a/modules/demux/ps.c b/modules/demux/ps.c
index bed63fea63ca9d20a766d6581bcb0ee1d658ce9c..1a6adab1ead903c8df7e17ac0a690d5ab80732be 100644 (file)
--- a/modules/demux/ps.c
+++ b/modules/demux/ps.c
@@ -559,10 +559,15 @@ static block_t *ps_pkt_read( stream_t *s, uint32_t i_code )
 {
     const uint8_t *p_peek;
     int      i_peek = stream_Peek( s, &p_peek, 14 );
-    int      i_size = ps_pkt_size( p_peek, i_peek );
+    int      i_size;
     VLC_UNUSED(i_code);
 
-    if( i_size <= 6 && p_peek[3] > 0xba )
+    /* Smallest valid packet */
+    if( i_peek < 6 ) return NULL;
+
+    i_size = ps_pkt_size( p_peek, i_peek );
+
+    if( i_size < 0 || ( i_size <= 6 && p_peek[3] > 0xba ) )
     {
         /* Special case, search the next start code */
         i_size = 6;

diff --git a/modules/demux/ps.h b/modules/demux/ps.h
index 145880d981e28ad05f0926505136117c71dcb540..2b415411606c1fa5fb0baf521f65711890cfadc1 100644 (file)
--- a/modules/demux/ps.h
+++ b/modules/demux/ps.h
@@ -22,6 +22,7 @@
  *****************************************************************************/
 
 #include <vlc_demux.h>
+#include <assert.h>
 
 /* 256-0xC0 for normal stream, 256 for 0xbd stream, 256 for 0xfd stream */
 #define PS_TK_COUNT (768 - 0xc0)
@@ -246,10 +247,11 @@ static inline int ps_pkt_id( block_t *p_pkt )
 }
 
 /* return the size of the next packet
- * XXX you need to give him at least 14 bytes (and it need to start as a
- * valid packet) */
+ * You need to give him at least 14 bytes (and it need to start as a
+ * valid packet) It does not handle less than 6 bytes */
 static inline int ps_pkt_size( const uint8_t *p, int i_peek )
 {
+    assert( i_peek >= 6 );
     if( p[3] == 0xb9 && i_peek >= 4 )
     {
         return 4;