mpegts: fix invalid memory access in language descriptor

Also add a couple sanity asserts/returns

https://bugzilla.gnome.org/show_bug.cgi?id=781024

diff --git a/gst-libs/gst/mpegts/gstmpegtsdescriptor.c b/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
index a49ce2a2c81a1eda60d46a8c9169e0052ca7e77c..079716e7fd21cba1b445384bba7c9428ec005427 100644 (file)
--- a/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
+++ b/gst-libs/gst/mpegts/gstmpegtsdescriptor.c
@@ -855,6 +855,7 @@ gst_mpegts_descriptor_from_registration (const gchar * format_identifier,
   GstMpegtsDescriptor *descriptor;
 
   g_return_val_if_fail (format_identifier != NULL, NULL);
+  g_return_val_if_fail (additional_info_length > 0 || !additional_info, NULL);
 
   descriptor = _new_descriptor (GST_MTS_DESC_REGISTRATION,
       4 + additional_info_length);
@@ -1055,7 +1056,7 @@ gst_mpegts_descriptor_from_iso_639_language (const gchar * language)
 
   g_return_val_if_fail (language != NULL, NULL);
 
-  descriptor = _new_descriptor (GST_MTS_DESC_ISO_639_LANGUAGE, 4 + 4);  /* a language takes 4 bytes */
+  descriptor = _new_descriptor (GST_MTS_DESC_ISO_639_LANGUAGE, 4);      /* a language takes 4 bytes */
 
   memcpy (descriptor->data + 2, language, 3);
   descriptor->data[2 + 3] = 0;  /* set audio type to undefined */
@@ -1116,6 +1117,8 @@ gst_mpegts_descriptor_from_custom (guint8 tag, const guint8 * data,
 {
   GstMpegtsDescriptor *descriptor;
 
+  g_return_val_if_fail (length > 0 || !data, NULL);
+
   descriptor = _new_descriptor (tag, length);
 
   if (data && (length > 0))