Browse Source

Harden the section parser

Georgi Chorbadzhiyski 9 years ago
parent
commit
6fcc4b5a4d
1 changed files with 21 additions and 20 deletions
  1. 21
    20
      tsfuncs_sections.c

+ 21
- 20
tsfuncs_sections.c View File

@@ -7,24 +7,24 @@
7 7
 
8 8
 #include "tsfuncs.h"
9 9
 
10
+#define have_left(X) \
11
+	do { if (data + (X) > data_end) return NULL; } while(0)
12
+
10 13
 uint8_t *ts_section_header_parse(uint8_t *ts_packet, struct ts_header *ts_header, struct ts_section_header *ts_section_header) {
11
-	if (ts_header->payload_offset + 8 > TS_PACKET_SIZE) {
12
-		ts_packet_header_dump(ts_header);
13
-		ts_LOGf("!!! Section start outside of TS packet %d!\n", ts_header->payload_offset + 8);
14
-		return NULL;
15
-	}
16
-
17 14
 	uint8_t *data = ts_packet + ts_header->payload_offset;
15
+	uint8_t *data_end = ts_packet + TS_PACKET_SIZE;
18 16
 
17
+	have_left(ts_section_header->pointer_field + 1);
19 18
 	ts_section_header->pointer_field = data[0];
20 19
 	data += ts_section_header->pointer_field + 1;
21 20
 
21
+	have_left(3);
22 22
 	ts_section_header->table_id                 = data[0];
23
-
24 23
 	ts_section_header->section_syntax_indicator = data[1] >> 7;				// x1111111
25 24
 	ts_section_header->private_indicator        = (data[1] &~ 0xBF) >> 6;	// 1x111111
26 25
 	ts_section_header->reserved1                = (data[1] &~ 0xCF) >> 4;	// 11xx1111
27 26
 	ts_section_header->section_length           = ((data[1] &~ 0xF0) << 8) | data[2]; // 1111xxxx xxxxxxxx
27
+	data += 3;
28 28
 
29 29
 	if (ts_section_header->section_length == 0)
30 30
 		return NULL;
@@ -34,25 +34,26 @@ uint8_t *ts_section_header_parse(uint8_t *ts_packet, struct ts_header *ts_header
34 34
 		return NULL;
35 35
 
36 36
 	if (ts_section_header->section_syntax_indicator) {
37
-		ts_section_header->ts_id_number             = (data[3] << 8) | data[4]; // xxxxxxx xxxxxxx
37
+		ts_section_header->data     = ts_section_header->section_data   + 3 + 5;	// Skip header and extended header
38
+		ts_section_header->data_len = ts_section_header->section_length - 9;		// 5 for extended header, 4 for crc at the end
38 39
 
39
-		ts_section_header->reserved2                = data[5] >> 6;				// xx111111
40
-		ts_section_header->version_number           = (data[5] &~ 0xC1) >> 1;	// 11xxxxx1
41
-		ts_section_header->current_next_indicator   = data[5] &~ 0xFE;			// 1111111x
42
-
43
-		ts_section_header->section_number           = data[6];
44
-		ts_section_header->last_section_number      = data[7];
45
-
46
-		ts_section_header->data = ts_section_header->section_data + 8; // Skip header
47
-		ts_section_header->data_len = ts_section_header->section_length - (5 + 4);	// 5 for extended syntax, 4 for crc at the end
48
-		return data + 8;
40
+		have_left(5);
41
+		ts_section_header->ts_id_number             = (data[0] << 8) | data[1]; // xxxxxxx xxxxxxx
42
+		ts_section_header->reserved2                =  data[2] >> 6;			// xx111111
43
+		ts_section_header->version_number           = (data[2] &~ 0xC1) >> 1;	// 11xxxxx1
44
+		ts_section_header->current_next_indicator   = data[2] &~ 0xFE;			// 1111111x
45
+		ts_section_header->section_number           = data[3];
46
+		ts_section_header->last_section_number      = data[4];
47
+		data += 5;
49 48
 	} else {
50
-		ts_section_header->data = ts_section_header->section_data + 3; // Skip header
49
+		ts_section_header->data     = ts_section_header->section_data + 3; // Skip header
51 50
 		ts_section_header->data_len = ts_section_header->section_length;
52
-		return data + 3;
53 51
 	}
52
+	return data;
54 53
 }
55 54
 
55
+#undef have_left
56
+
56 57
 void ts_section_header_generate(uint8_t *ts_packet, struct ts_section_header *ts_section_header, uint8_t start) {
57 58
 	ts_packet[start + 0] = ts_section_header->table_id;
58 59
 

Loading…
Cancel
Save