From af7562a03556d72ac6e022067b879d0124b052ba Mon Sep 17 00:00:00 2001
From: Carl Eugen Hoyos <cehoyos@ag.or.at>
Date: Thu, 5 Dec 2013 21:17:21 +0100
Subject: [PATCH] Ignore es_map_length when parsing mpeg program stream map.

Fixes ticket #3195.
---
 libavformat/mpeg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c
index 90434a1437..1777283939 100644
--- a/libavformat/mpeg.c
+++ b/libavformat/mpeg.c
@@ -193,6 +193,8 @@ static long mpegps_psm_parse(MpegDemuxContext *m, AVIOContext *pb)
     /* skip program_stream_info */
     avio_skip(pb, ps_info_length);
     es_map_length = avio_rb16(pb);
+    /* Ignore es_map_length, trust psm_length */
+    es_map_length = psm_length - ps_info_length - 10;
 
     /* at least one es available? */
     while (es_map_length >= 4){