Ignore es_map_length when parsing mpeg program stream map.

Fixes ticket #3195.

diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c
index 90434a1..1777283 100644 (file)
--- a/libavformat/mpeg.c
+++ b/libavformat/mpeg.c
@@ -193,6 +193,8 @@ static long mpegps_psm_parse(MpegDemuxContext *m, AVIOContext *pb)
     /* skip program_stream_info */
     avio_skip(pb, ps_info_length);
     es_map_length = avio_rb16(pb);
+    /* Ignore es_map_length, trust psm_length */
+    es_map_length = psm_length - ps_info_length - 10;
 
     /* at least one es available? */
     while (es_map_length >= 4){