avformat/mpegtsenc: Check remaining space in SDT

Fixes: out of array access
Fixes: VULN-8

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19c78cd6d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/mpegtsenc.c

@@ -50,6 +50,7 @@ typedef struct MpegTSSection {
     int discontinuity;
     void (*write_packet)(struct MpegTSSection *s, const uint8_t *packet);
     void *opaque;
+    int remaining;
 } MpegTSSection;
 
 typedef struct MpegTSService {
@@ -889,6 +890,10 @@ static MpegTSService *mpegts_add_service(AVFormatContext *s, int sid,
         av_log(s, AV_LOG_ERROR, "Too long service or provider name\n");
         goto fail;
     }
+    ts->sdt.remaining -= 10 + service->provider_name[0] + service->name[0];
+    if (ts->sdt.remaining < 0)
+        goto fail;
+
     if (av_dynarray_add_nofree(&ts->services, &ts->nb_services, service) < 0)
         goto fail;
 
@@ -997,6 +1002,8 @@ static int mpegts_init(AVFormatContext *s)
     // round up to a whole number of TS packets
     ts->pes_payload_size = (ts->pes_payload_size + 14 + 183) / 184 * 184 - 14;
 
+    ts->sdt.remaining    = SECTION_LENGTH - 3;
+
     if (!s->nb_programs) {
         /* allocate a single DVB service */
         if (!mpegts_add_service(s, ts->service_id, s->metadata, NULL))