Fix:MPEG PES decode reports "Malformed Packet" when PES packet length is 0

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2229

svn path=/trunk/; revision=26328

1 files changed, 18 insertions, 2 deletions

diff --git a/epan/dissectors/packet-mpeg-pes.c b/epan/dissectors/packet-mpeg-pes.c
index ed35ecea17..1087f37f5f 100644
--- a/epan/dissectors/packet-mpeg-pes.c
+++ b/epan/dissectors/packet-mpeg-pes.c
@@ -849,7 +849,15 @@ dissect_mpeg_pes(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
 			offset = dissect_mpeg_pes_Stream(tvb, offset, &asn1_ctx,
 					tree, hf_mpeg_pes_extension);
-			length -= 5 * 8;
+			/* https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2229
+			 * “A value of 0 indicates that the PES packet length is neither specified nor
+			 * bounded and is allowed only in PES packets whose payload is a video elementary
+			 * stream contained in Transport Stream packets.”
+			 * XXX Some one with access to the spec should check this
+			 */
+			if(length !=0 && stream != STREAM_VIDEO){
+				length -= 5 * 8;
+			}
 
 			header_length = tvb_get_guint8(tvb, 8);
 			if (header_length > 0) {
@@ -858,7 +866,15 @@ dissect_mpeg_pes(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 						header_length, header_length);
 				dissect_mpeg_pes_header_data(header_data, pinfo, tree, flags);
 				offset += header_length * 8;
-				length -= header_length * 8;
+				/* lenght may be zero for Video stream */
+				if(length !=0 && stream != STREAM_VIDEO){
+					length -= header_length * 8;
+				}
+			}
+			/* lenght may be zero for Video stream */
+			if(length==0){
+				proto_tree_add_item(tree, hf_mpeg_pes_data, tvb, (offset>>3),-1, FALSE);
+				return TRUE;
 			}
 
 			es = tvb_new_subset(tvb, offset / 8, -1, length / 8);