frodovdr
/
vdr
mirror of https://github.com/VDR4Arch/vdr.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fixed cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond the end of the given buffer

This commit is contained in:
Klaus Schmidinger 2004-11-16 16:57:43 +01:00
parent ac8e03a89c
commit 1d8676e85f
4 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CONTRIBUTORS
View File

@ -1079,6 +1079,9 @@ Marco Schl
for fixing the cDvbSpuDecoder for fixing the cDvbSpuDecoder
for fixing a short glitch when starting a recording on the primary device while for fixing a short glitch when starting a recording on the primary device while
in replay or transfer mode in replay or transfer mode
for fixing cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond
the end of the given buffer, which has caused some unjustified "unknown picture
type errors"
Jürgen Schmitz <j.schmitz@web.de> Jürgen Schmitz <j.schmitz@web.de>
for reporting a bug in displaying the current channel when switching via the SVDRP for reporting a bug in displaying the current channel when switching via the SVDRP

6
HISTORY
View File

@ -3138,3 +3138,9 @@ Video Disk Recorder Revision History
shot" and "repeating". The keys '1'...'7' can be used to toggle the individual shot" and "repeating". The keys '1'...'7' can be used to toggle the individual
days ('1' is monday). Thanks to Sascha Klek for reporting a problem with the days ('1' is monday). Thanks to Sascha Klek for reporting a problem with the
'0' key in the "Day" item of the "Timers" menu. '0' key in the "Day" item of the "Timers" menu.
2004-11-16: Version 1.3.17
- Fixed cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond
the end of the given buffer, which has caused some unjustified "unknown
picture type errors" (thanks to Marco Schlüßler).

6
config.h
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: config.h 1.204 2004/11/02 17:20:27 kls Exp $ * $Id: config.h 1.205 2004/11/16 16:57:43 kls Exp $
*/ */
#ifndef __CONFIG_H #ifndef __CONFIG_H
@ -20,8 +20,8 @@
#include "i18n.h" #include "i18n.h"
#include "tools.h" #include "tools.h"
#define VDRVERSION "1.3.16" #define VDRVERSION "1.3.17"
#define VDRVERSNUM 10316 // Version * 10000 + Major * 100 + Minor #define VDRVERSNUM 10317 // Version * 10000 + Major * 100 + Minor
#define MAXPRIORITY 99 #define MAXPRIORITY 99
#define MAXLIFETIME 99 #define MAXLIFETIME 99

4
remux.c
View File

@ -8,7 +8,7 @@
* the Linux DVB driver's 'tuxplayer' example and were rewritten to suit * the Linux DVB driver's 'tuxplayer' example and were rewritten to suit
* VDR's needs. * VDR's needs.
* *
* $Id: remux.c 1.21 2004/10/24 09:25:33 kls Exp $ * $Id: remux.c 1.22 2004/11/16 16:49:03 kls Exp $
*/ */
#include "remux.h" #include "remux.h"
@ -451,7 +451,7 @@ int cRemux::ScanVideoPacket(const uchar *Data, int Count, int Offset, uchar &Pic
if (Length >= 8) { if (Length >= 8) {
int i = Offset + 8; // the minimum length of the video packet header int i = Offset + 8; // the minimum length of the video packet header
i += Data[i] + 1; // possible additional header bytes i += Data[i] + 1; // possible additional header bytes
for (; i < Offset + Length; i++) { for (; i < Offset + Length - 5; i++) {
if (Data[i] == 0 && Data[i + 1] == 0 && Data[i + 2] == 1) { if (Data[i] == 0 && Data[i + 1] == 0 && Data[i + 2] == 1) {
switch (Data[i + 3]) { switch (Data[i + 3]) {
case SC_PICTURE: PictureType = (Data[i + 5] >> 3) & 0x07; case SC_PICTURE: PictureType = (Data[i + 5] >> 3) & 0x07;