diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 7468a023dff397067e19047444652ce97fc18164..226f5b28cba501999c4a3b879bcc6415969af39d 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -555,7 +555,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len if (desc_list_len < 0) break; desc_list_end = p + desc_list_len; - if (desc_list_end >= p_end) + if (desc_list_end > p_end) break; for(;;) { desc_tag = get8(&p, desc_list_end); @@ -571,6 +571,8 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len } } desc_len = get8(&p, desc_list_end); + if (desc_len < 0) + break; desc_end = p + desc_len; if (desc_end > desc_list_end) break;