diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index 90434a1437..1777283939 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -193,6 +193,8 @@ static long mpegps_psm_parse(MpegDemuxContext *m, AVIOContext *pb) /* skip program_stream_info */ avio_skip(pb, ps_info_length); es_map_length = avio_rb16(pb); + /* Ignore es_map_length, trust psm_length */ + es_map_length = psm_length - ps_info_length - 10; /* at least one es available? */ while (es_map_length >= 4){