[vdr] PMT in multiple TS packet bug

Frank Schmirler vdr at schmirler.de
Mon Jan 19 11:50:00 CET 2009

On Mon, 19 Jan 2009 11:20:45 +0100, Alexw wrote
> I have already tested the inversion. Reducing the length and after 
> moving to the new offset. This change does not solve the issue. The 
> Length variable can still decrease to a negative value.
> What happen when the byte offset is greater than 188?

Then the packet was broken and shouldn't have been processed at all. By
definition the pointer field is the number of bytes to skip in *this* TS
packet. As the pointer field is not covered by a CRC check, it could be wrong.
So you're right, it should be checked. Note that this does not only affect
cRemux::ParsePmt() but also cRemux::ParsePat().


More information about the vdr mailing list