[mythtv-commits] [MythTV/mythtv] 2b0cfb: Check adaptation field size when skipping adaptati...

kmdewaal noreply at github.com
Fri Dec 25 10:03:57 UTC 2020


  Branch: refs/heads/master
  Home:   https://github.com/MythTV/mythtv
  Commit: 2b0cfba827fa889f907f7a8cf0175fe360aae7a0
      https://github.com/MythTV/mythtv/commit/2b0cfba827fa889f907f7a8cf0175fe360aae7a0
  Author: Klaas de Waal <kdewaal at mythtv.org>
  Date:   2020-12-25 (Fri, 25 Dec 2020)

  Changed paths:
    M mythtv/libs/libmythtv/mpeg/pespacket.cpp

  Log Message:
  -----------
  Check adaptation field size when skipping adaptation field data

When copying the PES/PSI data from TS packets the adaptation fields are skipped, as
indicated by the value of the adaptation field control and the adaptation field size.
When the complete TS packet payload of 184 bytes is used for the adaptation field
the adaptation field size is 183 bytes; one byte is used for the adaptation field size.
When there are errors in the input stream, as can be caused by bad reception conditions
or by faulty equipment, the adaptation field size as received can have any value
up to 255. Any value higher than 183 leads to reading beyond the end of the incoming
TS packet and, even worse, leads to an attempt to copy close to UINT_MAX bytes.
This then causes a segmentation fault and termination of the backend.
Fixed by limiting the number of bytes to skip to the TS packet payload size of 184.




More information about the mythtv-commits mailing list