From 26d92b87bba99b5ea2e17b7eaa39c462d65e9133 Mon Sep 17 00:00:00 2001 From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= Date: Sat, 18 Oct 2008 22:19:49 +0300 Subject: [PATCH 1/1] Fix (yet another) TiVo demux overflow. Reported by Tobias Klein --- modules/demux/ty.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/demux/ty.c b/modules/demux/ty.c index 754e235bb4..65a408f67a 100644 --- a/modules/demux/ty.c +++ b/modules/demux/ty.c @@ -1639,12 +1639,14 @@ static void parse_master(demux_t *p_demux) /* parse all the entries */ p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t)); for (i=0; ii_seq_table_size; i++) { - stream_Read(p_demux->s, mst_buf, 8 + i_map_size); + stream_Read(p_demux->s, mst_buf, 8); p_sys->seq_table[i].l_timestamp = U64_AT(&mst_buf[0]); if (i_map_size > 8) { msg_Err(p_demux, "Unsupported SEQ bitmap size in master chunk"); + stream_Read(p_demux->s, NULL, i_map_size); memset(p_sys->seq_table[i].chunk_bitmask, i_map_size, 0); } else { + stream_Read(p_demux->s, mst_buf + 8, i_map_size); memcpy(p_sys->seq_table[i].chunk_bitmask, &mst_buf[8], i_map_size); } } -- 2.20.1