Blob Blame History Raw
diff --git a/wiretap/mpeg.c b/wiretap/mpeg.c
index 1500162..bd3ab24 100644
--- a/wiretap/mpeg.c
+++ b/wiretap/mpeg.c
@@ -111,7 +111,7 @@ mpeg_read_rec_data(FILE_T fh, guint8 *pd, int length, int *err,
 
 #define SCRHZ 27000000
 
-static gboolean 
+static gboolean
 mpeg_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 {
 	mpeg_t *mpeg = (mpeg_t *)wth->priv;
@@ -225,6 +225,18 @@ mpeg_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 	}
 	*data_offset = file_tell(wth->fh);
 
+	if (packet_size > WTAP_MAX_PACKET_SIZE) {
+		/*
+		 * Larger than we can handle. Don't blow up trying
+		 * to allocate space for an immensely-large packet
+		 * or clobber the stack.
+		 */
+		*err = WTAP_ERR_BAD_FILE;
+		*err_info = g_strdup_printf("mpeg: File has %u-byte packet, bigger than maximum of %u",
+				packet_size, WTAP_MAX_PACKET_SIZE);
+		return FALSE;
+	}
+
 	buffer_assure_space(wth->frame_buffer, packet_size);
 	if (!mpeg_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
 				packet_size, err, err_info))