On Sun, Oct 16, 2005 at 11:01:54PM +0200, Stephan Tesch wrote:
> #0 0x1c007cba in probe_picext (buffer=0x8a60effe "\205D" <Address 0x8a60f000
> out of bounds>)
>
> at
> /usr/ports/multimedia/transcode/w-transcode-0.6.14p2/transcode-0.6.14/import/aux_pes.c:277
> 277 return(buffer[2] & 3);
> (gdb) where
> #0 0x1c007cba in probe_picext (buffer=0x8a60effe "\205D" <Address 0x8a60f000
> out of bounds>)
>
> at
> /usr/ports/multimedia/transcode/w-transcode-0.6.14p2/transcode-0.6.14/import/aux_pes.c:277
> #1 0x1c00896d in scan_pack_ext (buf=0x8a60e800 "")
thanks.
can you try the following? should keep it from going out of bounds
at least. doesn't seem to cause any problems in the demuxing
as far as I can see.
--
<[EMAIL PROTECTED]>
$OpenBSD$
--- import/scan_pack.c.orig Sun Oct 16 16:02:57 2005
+++ import/scan_pack.c Sun Oct 16 16:29:02 2005
@@ -141,10 +141,10 @@ int scan_pack_ext(char *buf)
int n, ret_code=-1;
- for(n=0; n<VOB_PACKET_SIZE-4; ++n) {
+ for(n=0; n<VOB_PACKET_SIZE-6; ++n) {
if(_cmp_32_bits(buf+n, TC_MAGIC_PICEXT) && ((uint8_t) buf[n+4]>>4)==8){
- ret_code = probe_picext(buf+n+4);
+ ret_code = probe_picext((uint8_t *)buf+n+4);
}
} // probe extension header
