From dba31ffc1363c9fbc553bc93325a3af4e6ad70fd Mon Sep 17 00:00:00 2001
From: John Schember <john@nachtimwald.com>
Date: Tue, 3 Nov 2026 15:27:48 -0500
Subject: [PATCH] demux: reject packets with a negative length

---
 demux.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/demux.go b/demux.go
index 2f7a1bb..a80c01a 100644
--- a/demux.go
+++ b/demux.go
@@ -568,6 +568,11 @@ func (d *Demux) decodePacket(typ int) *Packet {
 }
 
 func (d *Demux) packet() *Packet {
+	if d.nextPacket.length < 0 {
+		d.nextPacket.length = 0
+		return nil // invalid
+	}
+
 	if !d.buf.has(d.nextPacket.length << 3) {
 		return nil
 	}