diff options
| author | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2009-05-27 00:46:20 +0000 |
|---|---|---|
| committer | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2009-05-27 00:46:20 +0000 |
| commit | a5685be502e510d97c950f1cac8043c7ce1f5ecf (patch) | |
| tree | b7f6e8538536bf891c951d62387d069181830c70 | |
| parent | 0c1375575a50406eebb5f01738710e469c9c1cd8 (diff) | |
| download | ffmpeg-a5685be502e510d97c950f1cac8043c7ce1f5ecf.tar.gz | |
check that len is not negative
Originally committed as revision 18961 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/mpegts.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 3b3835950c..244b9ed4c2 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -892,6 +892,8 @@ static void mpegts_push_data(MpegTSFilter *filter, /* PES packing parsing */ case MPEGTS_PESHEADER_FILL: len = pes->pes_header_size - pes->data_index; + if (len < 0) + return if (len > buf_size) len = buf_size; memcpy(pes->header + pes->data_index, p, len); |