From 471fa3a889f01c9b1f324f0b2fe181b90c894943 Mon Sep 17 00:00:00 2001 From: Derk-Jan Hartman Date: Fri, 10 Oct 2008 23:39:11 +0200 Subject: [PATCH] Fix potential static array overflow (CID 40 and 192) --- modules/demux/ps.h | 4 ++-- modules/demux/ts.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/demux/ps.h b/modules/demux/ps.h index 2b41541160..a15daad3cc 100644 --- a/modules/demux/ps.h +++ b/modules/demux/ps.h @@ -344,10 +344,10 @@ static inline int ps_pkt_parse_system( block_t *p_pkt, ps_psm_t *p_psm, /* Parse a PES (and skip i_skip_extra in the payload) */ static inline int ps_pkt_parse_pes( block_t *p_pes, int i_skip_extra ) { - uint8_t header[30]; + uint8_t header[34]; unsigned int i_skip = 0; - memcpy( header, p_pes->p_buffer, __MIN( p_pes->i_buffer, 30 ) ); + memcpy( header, p_pes->p_buffer, __MIN( p_pes->i_buffer, 34 ) ); switch( header[3] ) { diff --git a/modules/demux/ts.c b/modules/demux/ts.c index 57d9198073..862ccd6f39 100644 --- a/modules/demux/ts.c +++ b/modules/demux/ts.c @@ -1664,7 +1664,7 @@ static void PIDClean( es_out_t *out, ts_pid_t *pid ) static void ParsePES( demux_t *p_demux, ts_pid_t *pid ) { block_t *p_pes = pid->es->p_pes; - uint8_t header[30]; + uint8_t header[34]; int i_pes_size = 0; int i_skip = 0; mtime_t i_dts = -1; @@ -1679,7 +1679,7 @@ static void ParsePES( demux_t *p_demux, ts_pid_t *pid ) pid->es->pp_last = &pid->es->p_pes; /* FIXME find real max size */ - i_max = block_ChainExtract( p_pes, header, 30 ); + i_max = block_ChainExtract( p_pes, header, 34 ); if( header[0] != 0 || header[1] != 0 || header[2] != 1 ) -- 2.39.5