Ticket #2664: 2664-v1.patch

libs/libmythtv/mpeg/mpegstreamdata.cpp

@@ -692 +692 @@
         DONE_WITH_PES_PACKET(); // already parsed this table, toss it.
     }
 
-    HandleTables(tspacket->PID(), *psip);
+    if (psip->VerifyPSIP(!_have_CRC_bug))
+        HandleTables(tspacket->PID(), *psip);
+
     DONE_WITH_PES_PACKET();
 }
 #undef DONE_WITH_PES_PACKET

libs/libmythtv/mpeg/mpegtables.h

@@ -359 +359 @@
     // only for real ATSC PSIP tables, not similar MPEG2 tables
     void SetProtocolVersion(int ver) { pesdata()[8] = ver; }
 
+    const bool VerifyPSIP(bool verify_crc) const;
+
     const QString toString(void) const;
 
     static const uint PSIP_OFFSET = 8; // general PSIP header offset

libs/libmythtv/mpeg/mpegtables.cpp

@@ -66 +66 @@
     return stream_id;
 }
 
+const bool PSIPTable::VerifyPSIP(bool verify_crc) const
+{
+    if (verify_crc && (CalcCRC() != CRC()))
+    {
+        VERBOSE(VB_SIPARSER,
+                QString("PSIPTable: Failed CRC check 0x%1 != 0x%2 "
+                        "for StreamID = 0x%3")
+                .arg(CRC(),0,16).arg(CalcCRC(),0,16).arg(StreamID(),0,16));
+        return false;
+    }
+
+    unsigned char *bufend = _fullbuffer + _allocSize;
+
+    if ((_pesdata + 2) >= bufend)
+        return false; // can't query length
+
+    if (psipdata() >= bufend)
+        return false; // data outside buffer
+
+    if (TableID::PAT == TableID())
+    {
+        uint pcnt = (SectionLength() - PSIP_OFFSET - 2) >> 2;
+        return (psipdata() + (pcnt << 2) + 3 < bufend);
+    }
+
+    if (TableID::PMT == TableID())
+    {
+        if (psipdata() + 3 >= bufend)
+            return false; // can't query program info length
+
+        ProgramMapTable pmt(*this);
+        if ((pmt.ProgramInfo() > bufend) ||
+            (pmt.ProgramInfo() + pmt.ProgramInfoLength() > bufend))
+        {
+            return false;
+        }
+
+        for (uint i = 0; i < pmt.StreamCount(); i++)
+        {
+            if ((pmt.StreamInfo(i) > bufend) ||
+                (pmt.StreamInfo(i) + pmt.StreamInfoLength(i) > bufend))
+            {
+                return false;
+            }
+        }
+    }
+}
+
 ProgramAssociationTable* ProgramAssociationTable::CreateBlank(bool small)
 {
     (void) small; // currently always a small packet..

libs/libmythtv/mpeg/pespacket.h

@@ -249 +249 @@
 
     unsigned char *_pesdata;    ///< Pointer to PES data in full buffer
     unsigned char *_fullbuffer; ///< Pointer to allocated data
-  private:
+
     uint _psiOffset;    ///< AFCOffset + StartOfFieldPointer
     uint _ccLast;       ///< Continuity counter of last inserted TS Packet
     uint _pesdataSize;  ///< Number of data bytes (TS header + PES data)