[mythtv-commits] [MythTV/mythtv] 2b0cfb: Check adaptation field size when skipping adaptati...
noreply at github.com
Fri Dec 25 10:03:57 UTC 2020
Author: Klaas de Waal <kdewaal at mythtv.org>
Date: 2020-12-25 (Fri, 25 Dec 2020)
Check adaptation field size when skipping adaptation field data
When copying the PES/PSI data from TS packets the adaptation fields are skipped, as
indicated by the value of the adaptation field control and the adaptation field size.
When the complete TS packet payload of 184 bytes is used for the adaptation field
the adaptation field size is 183 bytes; one byte is used for the adaptation field size.
When there are errors in the input stream, as can be caused by bad reception conditions
or by faulty equipment, the adaptation field size as received can have any value
up to 255. Any value higher than 183 leads to reading beyond the end of the incoming
TS packet and, even worse, leads to an attempt to copy close to UINT_MAX bytes.
This then causes a segmentation fault and termination of the backend.
Fixed by limiting the number of bytes to skip to the TS packet payload size of 184.
More information about the mythtv-commits