From 7acd6b4d267e8cec330eca594d034552ff80d728 Mon Sep 17 00:00:00 2001
From: unichronic <ishuvam.pal@gmail.com>
Date: Fri, 20 Feb 2026 04:04:29 +0530
Subject: [PATCH] demux: add check to verify sequence table size to prevent oom

---
 modules/demux/ty.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/demux/ty.c b/modules/demux/ty.c
index 9ff5331fe3..a40a2149cf 100644
--- a/modules/demux/ty.c
+++ b/modules/demux/ty.c
@@ -1658,6 +1658,9 @@ static int parse_master(demux_t *p_demux)
     uint32_t i_map_size = U32_AT(&mst_buf[20]);  /* size of bitmask, in bytes */
     uint32_t i = U32_AT(&mst_buf[28]);   /* size of SEQ table, in bytes */
 
+    if( i_save_pos + 32 + i > p_sys->i_stream_size )
+        return VLC_EGENERIC;
+
     if(i_map_size > UINT32_MAX / 8)
         return VLC_EGENERIC;