The maximum allowed useful PES payload data was set to PES_packet_length, but
it is in fact smaller by the length of the PES header.
This changes how corrupt streams are packetized:
- If PES header length is bigger than PES_packet_length then the PES packet
payload will be handled as an unbound packet
- PES packets with payload across multiple MPEGTS packets will always be
splitted if with the next chunk of data the payload should exceed
PES_packet_length, previously a PES_header_length amount of excess was
allowed.
Fixes ticket #9355.
Signed-off-by: Marton Balint <c...@passwd.hu>
---
libavformat/mpegts.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 7d2e7407c1..0029c4ca76 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -1358,8 +1358,8 @@ skip:
case MPEGTS_PAYLOAD:
do {
int max_packet_size = MAX_PES_PAYLOAD;
- if (pes->PES_packet_length)
- max_packet_size = pes->PES_packet_length;
+ if (pes->PES_packet_length && pes->PES_packet_length +
PES_START_SIZE > pes->pes_header_size)
+ max_packet_size = pes->PES_packet_length + PES_START_SIZE
- pes->pes_header_size;
if (pes->data_index > 0 &&
pes->data_index + buf_size > max_packet_size) {
--
2.31.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
