diff --git a/Source/MediaInfo/Audio/File_Dts.cpp b/Source/MediaInfo/Audio/File_Dts.cpp index bc8990678..cf79f95f3 100644 --- a/Source/MediaInfo/Audio/File_Dts.cpp +++ b/Source/MediaInfo/Audio/File_Dts.cpp @@ -1692,6 +1692,8 @@ void File_Dts::Extensions() default: Extensions_Resynch(false); } + if (Element_Offset>Element_Size) + Element_Offset=Element_Size; //Prevent unsigned underflow in loop condition if handler left offset past asset boundary Element_End0(); } Element_Size=Element_Size_Save; @@ -1946,6 +1948,13 @@ void File_Dts::XLL() return; } auto Element_Size_Save=Element_Size; + if (Element_Offset_Start-3+LLFrameSize>Element_Size_Save) + { + BS_End(); + Element_End0(); + Skip_XX(Element_Size-Element_Offset, "(Unknown)"); + return; + } Element_Size=Element_Offset_Start-3+LLFrameSize; Get_S1 (4, NumChSetsInFrame, "NumChSetsInFrame"); NumChSetsInFrame++; Param_Info1(NumChSetsInFrame);