diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 21:02:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 21:02:17 +0100 |
| commit | 4a310a19dea268b541a099515d73fda04dc642e9 (patch) | |
| tree | ef03bcbc920422679d8cc8b6cf248acf7c49f443 | |
| parent | d629f3edaa39b48ac92ac5e5ae8440e35805b792 (diff) | |
| download | ffmpeg-4a310a19dea268b541a099515d73fda04dc642e9.tar.gz | |
mpegts: prevent get_bits64() from reading nonsense at the end.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mpegts.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 3d825fe193..e6c353df0e 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -693,6 +693,9 @@ static void new_pes_packet(PESContext *pes, AVPacket *pkt) static uint64_t get_bits64(GetBitContext *gb, int bits) { uint64_t ret = 0; + + if (get_bits_left(gb) < bits) + return AV_NOPTS_VALUE; while (bits > 17) { ret <<= 17; ret |= get_bits(gb, 17); |