From 70d4e5105bddded33457342f9d6f1c7502d87b69 Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Thu, 12 Jan 2012 12:25:54 +0100
Subject: [PATCH] Fixed a possible memory corruption in cTsToPes::GetPes()

---
 HISTORY | 2 ++
 remux.c | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY b/HISTORY
index b15ffa89..eb263c6e 100644
--- a/HISTORY
+++ b/HISTORY
@@ -6814,3 +6814,5 @@ Video Disk Recorder Revision History
   with version 5.3 or higher that can handle the DTV_DVBT2_PLP_ID call (thanks
   to Rolf Ahrenberg).
 - Fixed cConfig::Load() for g++ version 4.7.0 (thanks to Ville Skyttä).
+- Fixed a possible memory corruption in cTsToPes::GetPes() in case of broken
+  TS packets, e.g. when switching channels.
diff --git a/remux.c b/remux.c
index 78ab2940..ff4d49ba 100644
--- a/remux.c
+++ b/remux.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: remux.c 2.62 2011/09/04 13:09:06 kls Exp $
+ * $Id: remux.c 2.63 2012/01/12 12:07:58 kls Exp $
  */
 
 #include "remux.h"
@@ -701,6 +701,10 @@ const uchar *cTsToPes::GetPes(int &Length)
         uchar *p = data + offset - 6;
         if (p != data) {
            p -= 3;
+           if (p < data) {
+              Reset();
+              return NULL;
+              }
            memmove(p, data, 4);
            }
         int l = min(length - offset, MAXPESLENGTH);