[PATCH] m2ts: check descs_size read from input to prevent overflow (#2388)

Gbp-Pq: Name CVE-2023-1448.patch

diff --git a/src/media_tools/mpegts.c b/src/media_tools/mpegts.c
index 386d69977bb1be2ee197ac9b5935d0a5a72c038e..bc94cf48d87b8bdb1069ca57e6cad838e1bf02c4 100644 (file)
--- a/src/media_tools/mpegts.c
+++ b/src/media_tools/mpegts.c
@@ -807,6 +807,11 @@ static void gf_m2ts_process_sdt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *ses, GF
                descs_size = ((data[pos+3]&0xf)<<8) | data[pos+4];
                pos += 5;
 
+               if (pos+descs_size > data_size) {
+                       GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[MPEG-2 TS] Invalid descriptors size read from data (%u)\n"));
+                       return;
+               }
+
                d_pos = 0;
                while (d_pos < descs_size) {
                        u8 d_tag = data[pos+d_pos];