On Mon, 19 Jan 2009 11:20:45 +0100, Alexw wrote > I have already tested the inversion. Reducing the length and after > moving to the new offset. This change does not solve the issue. The > Length variable can still decrease to a negative value. > > What happen when the byte offset is greater than 188? Then the packet was broken and shouldn't have been processed at all. By definition the pointer field is the number of bytes to skip in *this* TS packet. As the pointer field is not covered by a CRC check, it could be wrong. So you're right, it should be checked. Note that this does not only affect cRemux::ParsePmt() but also cRemux::ParsePat(). Regards, Frank _______________________________________________ vdr mailing list vdr@xxxxxxxxxxx http://www.linuxtv.org/cgi-bin/mailman/listinfo/vdr
