From b34ea7f094998f2885dd77a1a442a455ea1c5956 Mon Sep 17 00:00:00 2001
From: Christophe Massiot <massiot@via.ecp.fr>
Date: Sun, 15 Aug 2010 12:43:50 +0000
Subject: [PATCH] * mpeg/psi.h: Fix an infinite loop when receiving an invalid
 section.

---
 mpeg/psi.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mpeg/psi.h b/mpeg/psi.h
index 817f2ec..8935671 100644
--- a/mpeg/psi.h
+++ b/mpeg/psi.h
@@ -539,6 +539,11 @@ static inline uint8_t *psi_assemble_payload(uint8_t **pp_psi_buffer,
         uint16_t i_section_size = psi_get_length(*pp_psi_buffer)
                                    + PSI_HEADER_SIZE;
 
+        if (i_section_size > PSI_PRIVATE_MAX_SIZE) {
+            /* invalid section */
+            psi_assemble_reset(pp_psi_buffer, pi_psi_buffer_used);
+            return NULL;
+        }
         if (i_section_size <= *pi_psi_buffer_used) {
             p_section = *pp_psi_buffer;
             i_copy_size -= (*pi_psi_buffer_used - i_section_size);