https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6908
Summary: wiretap mpeg2 ts: more thorough check for sync byte
Product: Wireshark
Version: SVN
Platform: x86
OS/Version: All
Status: NEW
Severity: Normal
Priority: Low
Component: Wireshark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: wireshark@xxxxxxxxx
Build Information:
TShark 1.7.1 (SVN Rev 41332 from /trunk)
Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.24.2, with libpcap, without libz, without POSIX
capabilities, without SMI, without c-ares, without ADNS, without Lua, without
Python, without GnuTLS, with Gcrypt 1.4.5, without Kerberos, without GeoIP.
Running on Linux 2.6.39-bpo.2-amd64, with locale en_US.UTF-8, with libpcap
version 1.1.1.
Built using gcc 4.4.5.
--
Dear all,
I'd like to propose a stricter checking in the mp2t routine that determines if
a file is actually an mpeg2 transport stream. At the moment, we read 188 bytes,
if we find a 0x47 somewhere, we conclude that we have a ts.
(I have my private file format plugin for my DVB-CI hardware's raw data. This
plugin registers after all standard file types. Since the mp2t has been in, all
my files are recognized as mp2t because they normally have a 0x47 byte near the
start.)
My interpretation of the mpeg spec is different: The 0x47 _must_ appear at the
start of each 188 byte packet, additional 0x47 bytes _may_ appear anywhere.
Therefore, I propose that we read 10 packets and check that they all start with
0x47. If the file has less than 10 packets, we're ok if each one starts with a
0x47 byte.
I'll attach some files for testing things.
fake.ts -> random data containing a 0x47, no valid ts
8packetsOk.ts -> valid ts, 8 packets
20packetsOk.ts -> valid ts, 20 packets
8.xxPackets.ts -> valid ts, 8 packets + part of a 9th packet
I'll try to put Weston Schmidt, who submitted the mp2t, in Cc.
Thanks for review and merging.
Martiin
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.