From 83f33f4b70657b34acd75317314eb0d63a0c35bd Mon Sep 17 00:00:00 2001
From: Edward Hervey <edward@centricular.com>
Date: Sat, 26 Nov 2016 10:23:01 +0100
Subject: [PATCH 3/4] mpegtssection: Fix PAT parsing

Use the estimated number of programs for parsing. Avoids over-reading.

https://bugzilla.gnome.org/show_bug.cgi?id=775120
---
 gst-libs/gst/mpegts/gstmpegtssection.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/gst-libs/gst/mpegts/gstmpegtssection.c b/gst-libs/gst/mpegts/gstmpegtssection.c
index 527ff38..62a1f56 100644
--- a/gst-libs/gst/mpegts/gstmpegtssection.c
+++ b/gst-libs/gst/mpegts/gstmpegtssection.c
@@ -414,7 +414,7 @@ static gpointer
 _parse_pat (GstMpegtsSection * section)
 {
   GPtrArray *pat;
-  guint16 i = 0, nb_programs;
+  guint16 i, nb_programs;
   GstMpegtsPatProgram *program;
   guint8 *data, *end;
 
@@ -430,7 +430,9 @@ _parse_pat (GstMpegtsSection * section)
       g_ptr_array_new_full (nb_programs,
       (GDestroyNotify) _mpegts_pat_program_free);
 
-  while (data < end - 4) {
+  GST_LOG ("nb_programs %u", nb_programs);
+
+  for (i = 0; i < nb_programs; i++) {
     program = g_slice_new0 (GstMpegtsPatProgram);
     program->program_number = GST_READ_UINT16_BE (data);
     data += 2;
@@ -439,8 +441,6 @@ _parse_pat (GstMpegtsSection * section)
     data += 2;
 
     g_ptr_array_index (pat, i) = program;
-
-    i++;
   }
   pat->len = nb_programs;
 
-- 
2.9.3