Re: update: multimedia/transcode

[Jacob Meuser <jakemsr_(_at_)_jakemsr_(_dot_)_com>]

On Sun, Oct 16, 2005 at 11:01:54PM +0200, Stephan Tesch wrote:

> #0  0x1c007cba in probe_picext (buffer=0x8a60effe "\205D" <Address 0x8a60f000 
> out of bounds>)
>     
> at /usr/ports/multimedia/transcode/w-transcode-0.6.14p2/transcode-0.6.14/import/aux_pes.c:277
> 277       return(buffer[2] & 3);
> (gdb) where
> #0  0x1c007cba in probe_picext (buffer=0x8a60effe "\205D" <Address 0x8a60f000 
> out of bounds>)
>     
> at /usr/ports/multimedia/transcode/w-transcode-0.6.14p2/transcode-0.6.14/import/aux_pes.c:277
> #1  0x1c00896d in scan_pack_ext (buf=0x8a60e800 "")

thanks.

can you try the following?  should keep it from going out of bounds
at least.  doesn't seem to cause any problems in the demuxing
as far as I can see.

-- 
<jakemsr_(_at_)_jakemsr_(_dot_)_com>

$OpenBSD$
--- import/scan_pack.c.orig	Sun Oct 16 16:02:57 2005
+++ import/scan_pack.c	Sun Oct 16 16:29:02 2005
@@ -141,10 +141,10 @@ int scan_pack_ext(char *buf)
 
   int n, ret_code=-1;
   
-  for(n=0; n<VOB_PACKET_SIZE-4; ++n) {
+  for(n=0; n<VOB_PACKET_SIZE-6; ++n) {
       
       if(_cmp_32_bits(buf+n, TC_MAGIC_PICEXT) && ((uint8_t) buf[n+4]>>4)==8){
-	  ret_code = probe_picext(buf+n+4);
+	  ret_code = probe_picext((uint8_t *)buf+n+4);
       }
   } // probe extension header