From: Rémi Denis-Courmont Date: Sat, 18 Oct 2008 19:19:49 +0000 (+0300) Subject: Fix (yet another) TiVo demux overflow. X-Git-Tag: 1.0.0-pre1~2427 X-Git-Url: https://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;p=vlc.git;a=commitdiff_plain;h=26d92b87bba99b5ea2e17b7eaa39c462d65e9133;hp=2132eadea2f89b9662053ef8600fc514493dd0ab;ds=sidebyside Fix (yet another) TiVo demux overflow. Reported by Tobias Klein --- diff --git a/modules/demux/ty.c b/modules/demux/ty.c index 754e235bb4..65a408f67a 100644 --- a/modules/demux/ty.c +++ b/modules/demux/ty.c @@ -1639,12 +1639,14 @@ static void parse_master(demux_t *p_demux) /* parse all the entries */ p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t)); for (i=0; ii_seq_table_size; i++) { - stream_Read(p_demux->s, mst_buf, 8 + i_map_size); + stream_Read(p_demux->s, mst_buf, 8); p_sys->seq_table[i].l_timestamp = U64_AT(&mst_buf[0]); if (i_map_size > 8) { msg_Err(p_demux, "Unsupported SEQ bitmap size in master chunk"); + stream_Read(p_demux->s, NULL, i_map_size); memset(p_sys->seq_table[i].chunk_bitmask, i_map_size, 0); } else { + stream_Read(p_demux->s, mst_buf + 8, i_map_size); memcpy(p_sys->seq_table[i].chunk_bitmask, &mst_buf[8], i_map_size); } }