frodovdr/vdr
1
0
Fork 0
mirror of https://github.com/VDR4Arch/vdr.git synced 2023-10-10 13:36:52 +02:00
Code Issues Releases Wiki Activity

Fixed an out-of-bounds memory access with audio language ids

Browse Source
This commit is contained in:
Klaus Schmidinger 2005-08-06 12:29:38 +02:00
parent ff5df8f298
commit 16c3b8f0e7
4 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CONTRIBUTORS
View File

@ -1248,6 +1248,7 @@ Udo Richter <udo_richter@gmx.de>
for reporting a problem in handling page up/down in menu lists in case there are for reporting a problem in handling page up/down in menu lists in case there are
several non selectable items in a row several non selectable items in a row
for fixing handling 'page down' after it was broken in version 1.3.26 for fixing handling 'page down' after it was broken in version 1.3.26
for suggesting a fix for an out-of-bounds memory access with audio language ids
Sven Kreiensen <svenk@kammer.uni-hannover.de> Sven Kreiensen <svenk@kammer.uni-hannover.de>
for his help in keeping 'channels.conf.terr' up to date for his help in keeping 'channels.conf.terr' up to date
@ -1402,3 +1403,6 @@ Henrik Niehaus <henrik.niehaus@gmx.de>
Martin Wache <M.Wache@gmx.net> Martin Wache <M.Wache@gmx.net>
for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the
device, which avoids a busy loop on very fast machines device, which avoids a busy loop on very fast machines
Matthias Lenk <matthias.lenk@amd.com>
for reporting an out-of-bounds memory access with audio language ids

2
HISTORY
View File

@ -3657,3 +3657,5 @@ Video Disk Recorder Revision History
umask settings (thanks to Andreas Brachold). umask settings (thanks to Andreas Brachold).
- Fixed the cChannel copy constructor (thanks to Marcel Wiesweg for pointing out - Fixed the cChannel copy constructor (thanks to Marcel Wiesweg for pointing out
a problem with it). a problem with it).
- Fixed an out-of-bounds memory access with audio language ids (thanks to
Matthias Lenk for reporting, and Udo Richter for suggesting a fix).

8
channels.c
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: channels.c 1.43 2005/08/06 12:06:37 kls Exp $ * $Id: channels.c 1.44 2005/08/06 12:22:41 kls Exp $
*/ */
#include "channels.h" #include "channels.h"
@ -446,14 +446,16 @@ void cChannel::SetPids(int Vpid, int Ppid, int *Apids, char ALangs[][4], int *Dp
dsyslog("changing pids of channel %d from %d+%d:%s:%d to %d+%d:%s:%d", Number(), vpid, ppid, OldApidsBuf, tpid, Vpid, Ppid, NewApidsBuf, Tpid); dsyslog("changing pids of channel %d from %d+%d:%s:%d to %d+%d:%s:%d", Number(), vpid, ppid, OldApidsBuf, tpid, Vpid, Ppid, NewApidsBuf, Tpid);
vpid = Vpid; vpid = Vpid;
ppid = Ppid; ppid = Ppid;
for (int i = 0; i <= MAXAPIDS; i++) { // <= to copy the terminating 0 for (int i = 0; i < MAXAPIDS; i++) {
apids[i] = Apids[i]; apids[i] = Apids[i];
strn0cpy(alangs[i], ALangs[i], 4); strn0cpy(alangs[i], ALangs[i], 4);
} }
for (int i = 0; i <= MAXDPIDS; i++) { // <= to copy the terminating 0 apids[MAXAPIDS] = 0;
for (int i = 0; i < MAXDPIDS; i++) {
dpids[i] = Dpids[i]; dpids[i] = Dpids[i];
strn0cpy(dlangs[i], DLangs[i], 4); strn0cpy(dlangs[i], DLangs[i], 4);
} }
dpids[MAXDPIDS] = 0;
tpid = Tpid; tpid = Tpid;
modification |= mod; modification |= mod;
Channels.SetModified(); Channels.SetModified();

8
pat.c
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: pat.c 1.12 2005/01/25 21:02:11 kls Exp $ * $Id: pat.c 1.13 2005/08/06 12:23:51 kls Exp $
*/ */
#include "pat.h" #include "pat.h"
@ -324,10 +324,10 @@ void cPatFilter::Process(u_short Pid, u_char Tid, const u_char *Data, int Length
SI::PMT::Stream stream; SI::PMT::Stream stream;
int Vpid = 0; int Vpid = 0;
int Ppid = pmt.getPCRPid(); int Ppid = pmt.getPCRPid();
int Apids[MAXAPIDS + 1] = { 0 }; int Apids[MAXAPIDS + 1] = { 0 }; // these lists are zero-terminated
int Dpids[MAXDPIDS + 1] = { 0 }; int Dpids[MAXDPIDS + 1] = { 0 };
char ALangs[MAXAPIDS + 1][4] = { "" }; char ALangs[MAXAPIDS][4] = { "" };
char DLangs[MAXDPIDS + 1][4] = { "" }; char DLangs[MAXDPIDS][4] = { "" };
int Tpid = 0; int Tpid = 0;
int NumApids = 0; int NumApids = 0;
int NumDpids = 0; int NumDpids = 0;