From 7f6940fb8b511640a453d575fea3d97b6f2ba3bf Mon Sep 17 00:00:00 2001
From: olly <olly@google.com>
Date: Fri, 7 Aug 2020 15:26:21 +0100
Subject: [PATCH] TS EsInfo: Be robust against a invalid descriptor length

Issue: Issue: #7722
PiperOrigin-RevId: 325431839
---
 .../google/android/exoplayer2/extractor/ts/TsExtractor.java   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/library/extractor/src/main/java/com/google/android/exoplayer2/extractor/ts/TsExtractor.java b/library/extractor/src/main/java/com/google/android/exoplayer2/extractor/ts/TsExtractor.java
index eb8e721a0c..7c48720c61 100644
--- a/library/extractor/src/main/java/com/google/android/exoplayer2/extractor/ts/TsExtractor.java
+++ b/library/extractor/src/main/java/com/google/android/exoplayer2/extractor/ts/TsExtractor.java
@@ -666,6 +666,10 @@ public final class TsExtractor implements Extractor {
         int descriptorTag = data.readUnsignedByte();
         int descriptorLength = data.readUnsignedByte();
         int positionOfNextDescriptor = data.getPosition() + descriptorLength;
+        if (positionOfNextDescriptor > descriptorsEndPosition) {
+          // Descriptor claims to extend past the end position. Skip it.
+          break;
+        }
         if (descriptorTag == TS_PMT_DESC_REGISTRATION) { // registration_descriptor
           long formatIdentifier = data.readUnsignedInt();
           if (formatIdentifier == AC3_FORMAT_IDENTIFIER) {