Ticket #2147: pes_assembler_fixes.diff

libs/libmythtv/mpeg/pespacket.cpp

@@ -20 +20 @@
 // return true if complete or broken
 bool PESPacket::AddTSPacket(const TSPacket* packet)
 {
-    // +3 = first 3 bytes of pespacket header, not included in Length()
-    uint tlen = Length() + (_pesdata - _fullbuffer) +3;
-
     if (!tsheader()->PayloadStart())
     {
         VERBOSE(VB_RECORD, "Error: We started a PES packet, "
@@ -75 +72 @@
     else
     {
         VERBOSE(VB_RECORD, "AddTSPacket: Out of sync!!! "
-                "Need to wait for next payloadStart");
+                "Need to wait for next payloadStart" +
+                QString(" PID: 0x%1, continuity counter: %2 (expected %3).")
+                .arg(packet->PID(),0,16).arg(cc).arg(ccExp));
         return true;
     }
 
-    if (_pesdataSize >= tlen)
+    // check if it's safe to call Length
+    if ((_psiOffset + 1 + 3) <=  _pesdataSize)
     {
-        _badPacket = !VerifyCRC();
-        return true;
+        // +3 = first 3 bytes of pespacket header, not included in Length()
+        uint tlen = Length() + (_pesdata - _fullbuffer) +3;
+
+        if (_pesdataSize >= tlen)
+        {
+            _badPacket = !VerifyCRC();
+            return true;
+        }
     }
 
     return false;

libs/libmythtv/mpeg/mpegstreamdata.cpp

@@ -204 +204 @@
     PESPacket* partial = GetPartialPES(tspacket->PID());
     if (partial && partial->AddTSPacket(tspacket))
     {
+        // check if it's safe to read pespacket's Length()
+        if ((partial->PSIOffset() + 1 + 3) > partial->TSSizeInBuffer())
+        {
+            VERBOSE(VB_RECORD,
+                    QString("Discarding broken PES packet. Packet's length at "
+                            "position %1 isn't in the buffer of %2 bytes.")
+                    .arg(partial->PSIOffset() + 1 + 3)
+                    .arg(partial->TSSizeInBuffer()));
+            DeletePartialPES(tspacket->PID());
+            return NULL;
+        }
+
         // Discard broken packets
         bool buggy = _have_CRC_bug &&
         ((TableID::PMT == partial->StreamID()) ||
@@ -242 +254 @@
                 return psip;
             }
         }
+        // discard incomplete packets
+        if (packetStart > partial->TSSizeInBuffer())
+        {
+            VERBOSE(VB_RECORD,
+                    QString("Discarding broken PES packet. Packet with %1 bytes"
+                            " doesn't fit into a buffer of %2 bytes.")
+                    .arg(packetStart).arg(partial->TSSizeInBuffer()));
+            delete psip;
+            psip = NULL;
+        }
 
         moreTablePackets = false;
         DeletePartialPES(tspacket->PID());
@@ -275 +297 @@
 
     const unsigned char* pesdata = tspacket->data() + offset;
     const int pes_length = (pesdata[2] & 0x0f) << 8 | pesdata[3];
-    const PESPacket pes = PESPacket::View(*tspacket);
     if ((pes_length + offset + extra_offset) > 188)
     {
         SavePartialPES(tspacket->PID(), new PESPacket(*tspacket));

libs/libmythtv/mpeg/pespacket.h

@@ -30 +30 @@
             VERBOSE(VB_IMPORTANT, "Started PESPacket, but !payloadStart()");
             _psiOffset = tspacket.AFCOffset();
         }
-        _pesdata = tspacket.data() + tspacket.AFCOffset() + 1;
+        _pesdata = tspacket.data() + _psiOffset + 1;
 
         _badPacket = true;
         // first check if Length() will return something useful and