Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent RangeError exception when parsing incomplete PES #2463

Merged
merged 1 commit into from Dec 6, 2019
Merged

Prevent RangeError exception when parsing incomplete PES #2463

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/demux/tsdemuxer.js
View file
Open in desktop
Expand Up @@ -499,6 +499,9 @@ class TSDemuxer {
// 9 bytes : 6 bytes for PES header + 3 bytes for PES extension
payloadStartOffset = pesHdrLen + 9;

if (stream.size <= payloadStartOffset) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine by me, however could we simply modify the pre-existing safety checks that exist on lines 439-440?
What you have here now may cover other cases that I'm not considering, but I thought I would ask 😄

The safety check I'm referencing:

    // safety check
    if (!stream || stream.size === 0) {
      return null;
    }

Copy link
Collaborator Author

@robwalch robwalch Dec 6, 2019 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michaelcunningham19 I'd like to, but I'm not certain what the length of payloadStartOffset will be at this point.

hls.js/src/demux/tsdemuxer.js

Line 500 in ffe1569

payloadStartOffset = pesHdrLen + 9;

I think we could change the safety check to || stream.size < 10) { but that still wont cover cases where pesHdrLen ends up topping the input size.

return null;
}
stream.size -= payloadStartOffset;
// reassemble PES packet
pesData = new Uint8Array(stream.size);
Expand Down