From 1715cdd0c8503f48cee2048fc45cd24bbe60251b Mon Sep 17 00:00:00 2001
From: eumagga0x2a <eumagga0x2a@users.noreply.github.com>
Date: Mon, 3 Oct 2022 12:44:01 +0200
Subject: [PATCH 04/10] [demuxers/MpegTS] Add additional protection against
 overflow

---
 avidemux_plugins/ADM_demuxers/MpegTS/dmxTSPacket.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/avidemux_plugins/ADM_demuxers/MpegTS/dmxTSPacket.cpp b/avidemux_plugins/ADM_demuxers/MpegTS/dmxTSPacket.cpp
index b27a0397b..a6aa630eb 100644
--- a/avidemux_plugins/ADM_demuxers/MpegTS/dmxTSPacket.cpp
+++ b/avidemux_plugins/ADM_demuxers/MpegTS/dmxTSPacket.cpp
@@ -350,6 +350,7 @@ bool tsPacket::getNextPSI(uint32_t pid,TS_PSIpacketInfo *psi)
     uint32_t dummy;
     TSpacketInfo pkt;
     uint8_t *ptr = psi->payload;
+    uint8_t *end = ptr + TS_PSI_MAX_LEN;
 nextPack2:
     if(nbRetries && pkt.startAt-startOffset>(1<<25)) // max. 32 MiB
     {
@@ -451,6 +452,7 @@ nextPack2:
     while(true)
     {
         int chunk = (pkt.payloadSize > remaining)? remaining : pkt.payloadSize;
+        ADM_assert(ptr + chunk < end);
         memcpy(ptr, pkt.payload, chunk); // we keep PSI table header here
         ptr += chunk;
         remaining -= chunk;
-- 
2.30.4