From: Edward Hervey <bilboed@bilboed.com>
Date: Tue, 27 May 2014 15:25:25 +0000 (+0200)
Subject: mpegts: Fix Extended DVB descriptor parsing
X-Git-Tag: 1.3.3~262
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f7b1b5fcd3e1f24a34aa5217724efca5c261756b;p=platform%2Fupstream%2Fgst-plugins-bad.git

mpegts: Fix Extended DVB descriptor parsing

We were over-reading data, and the nb_items field isn't needed,
it's a property of the GPtrArray
---

diff --git a/gst-libs/gst/mpegts/gst-dvb-descriptor.c b/gst-libs/gst/mpegts/gst-dvb-descriptor.c
index 662a179..0dbdb62 100644
--- a/gst-libs/gst/mpegts/gst-dvb-descriptor.c
+++ b/gst-libs/gst/mpegts/gst-dvb-descriptor.c
@@ -924,10 +924,9 @@ gboolean
 gst_mpegts_descriptor_parse_dvb_extended_event (const GstMpegTsDescriptor
     * descriptor, GstMpegTsExtendedEventDescriptor * res)
 {
-  guint8 *data, *desc_data;
+  guint8 *data, *pdata;
   guint8 tmp, len_item;
   GstMpegTsExtendedEventItem *item;
-  guint i;
 
   g_return_val_if_fail (descriptor != NULL && res != NULL, FALSE);
   /* Need at least 6 bytes (1 for desc number, 3 for language code, 2 for the loop length) */
@@ -946,32 +945,30 @@ gst_mpegts_descriptor_parse_dvb_extended_event (const GstMpegTsDescriptor
   data += 3;
 
   len_item = *data;
+  if (len_item > descriptor->length - 5)
+    return FALSE;
 
   data += 1;
 
-  res->nb_items = 0;
   res->items = g_ptr_array_new_with_free_func ((GDestroyNotify)
       _gst_mpegts_extended_event_item_free);
 
-  for (i = 0; i < len_item;) {
-    desc_data = data;
+  pdata = data + len_item;
+  while (data < pdata) {
     item = g_slice_new0 (GstMpegTsExtendedEventItem);
     item->item_description =
-        get_encoding_and_convert ((const gchar *) desc_data + 1, *desc_data);
+        get_encoding_and_convert ((const gchar *) data + 1, *data);
 
-    desc_data += *desc_data + 1;
-    i += *desc_data + 1;
+    data += *data + 1;
 
-    item->item =
-        get_encoding_and_convert ((const gchar *) desc_data + 1, *desc_data);
+    item->item = get_encoding_and_convert ((const gchar *) data + 1, *data);
 
-    desc_data += *desc_data + 1;
-    i += *desc_data + 1;
+    data += *data + 1;
 
     g_ptr_array_add (res->items, item);
-    res->nb_items += 1;
   }
-  data += len_item;
+  if (pdata != data)
+    return FALSE;
   res->text = get_encoding_and_convert ((const gchar *) data + 1, *data);
 
   return TRUE;
diff --git a/gst-libs/gst/mpegts/gst-dvb-descriptor.h b/gst-libs/gst/mpegts/gst-dvb-descriptor.h
index edf5309..ed22482 100644
--- a/gst-libs/gst/mpegts/gst-dvb-descriptor.h
+++ b/gst-libs/gst/mpegts/gst-dvb-descriptor.h
@@ -473,8 +473,6 @@ struct _GstMpegTsExtendedEventItem
  * GstMpegTsExtendedEventDescriptor:
  * @desctiptor_number:
  * @last_descriptor_number:
- * @language_code:
- * @nb_items:
  * @items: (element-type GstMpegTsExtendedEventItem): the #GstMpegTsExtendedEventItem
  * @text:
  *
@@ -485,7 +483,6 @@ struct _GstMpegTsExtendedEventDescriptor
   guint8 descriptor_number;
   guint8 last_descriptor_number;
   gchar  language_code[3];
-  guint8 nb_items;
   GPtrArray *items;
   gchar *text;
 };