From 6a9e0bd35e2fc1c8891cf3264ae0c0f56046e253 Mon Sep 17 00:00:00 2001
From: Rob Walch <rob@jwplayer.com>
Date: Tue, 1 Jun 2021 12:00:04 -0400
Subject: [PATCH] Avoid RangeError in AAC PES overflow handling Followup to
 #3926

---
 src/demux/tsdemuxer.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/demux/tsdemuxer.ts b/src/demux/tsdemuxer.ts
index 0337f2e01df..b12eb905c99 100644
--- a/src/demux/tsdemuxer.ts
+++ b/src/demux/tsdemuxer.ts
@@ -941,9 +941,9 @@ class TSDemuxer implements Demuxer {
     const data = pes.data;
     if (aacOverFlow) {
       this.aacOverFlow = null;
-      const frameMissingBytes = aacOverFlow.missing;
-      const frameOverflowBytes =
-        aacOverFlow.sample.unit.byteLength - frameMissingBytes;
+      const sampleLength = aacOverFlow.sample.unit.byteLength;
+      const frameMissingBytes = Math.min(aacOverFlow.missing, sampleLength);
+      const frameOverflowBytes = sampleLength - frameMissingBytes;
       aacOverFlow.sample.unit.set(
         data.subarray(0, frameMissingBytes),
         frameOverflowBytes
@@ -951,7 +951,7 @@ class TSDemuxer implements Demuxer {
       track.samples.push(aacOverFlow.sample);
 
       // logger.log(`AAC: append overflowing ${frameOverflowBytes} bytes to beginning of new PES`);
-      startOffset = frameMissingBytes;
+      startOffset = aacOverFlow.missing;
     }
     // look for ADTS header (0xFFFx)
     let offset: number;