From 250e79afbea1e952c9c8faa4c4c52aab60a7f7ef Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Sun, 30 Jan 2005 12:11:56 +0100
Subject: [PATCH] Fixed a buffer overflow in case a station defines all 32
 audio PIDs

---
 CONTRIBUTORS |  1 +
 HISTORY      |  2 ++
 pat.c        | 10 +++++-----
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 14f3b012..8e5425f7 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -795,6 +795,7 @@ Benjamin Harling <benjamin.harling@web.de>
 Christian Jacobsen <christian.jacobsen@stageholding.de>
  for making the LIRC interface skip keys that come in too fast
  for reporting a problem in handling the '-E' options in version 1.3.18
+ for reporting a problem in case a station defines all 32 audio PIDs
 
 Andreas Mair <Andreas.Mair@linogate.com>
  for reporting a short display of the main menu if a plugin displays its own OSD and
diff --git a/HISTORY b/HISTORY
index de075740..030db1c2 100644
--- a/HISTORY
+++ b/HISTORY
@@ -3341,3 +3341,5 @@ Video Disk Recorder Revision History
 - Now setting primaryDevice = NULL before deleting the devices in cDevice::Shutdown()
   to avoid problems in case other threads access it (thanks to Wolfgang Rohdewald for
   pointing this out).
+- Fixed a buffer overflow in case a station defines all 32 audio PIDs (thanks to
+  Christian Jacobsen for reporting this one).
diff --git a/pat.c b/pat.c
index 48ea715f..356e28ef 100644
--- a/pat.c
+++ b/pat.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: pat.c 1.11 2005/01/16 13:54:34 kls Exp $
+ * $Id: pat.c 1.12 2005/01/25 21:02:11 kls Exp $
  */
 
 #include "pat.h"
@@ -324,10 +324,10 @@ void cPatFilter::Process(u_short Pid, u_char Tid, const u_char *Data, int Length
         SI::PMT::Stream stream;
         int Vpid = 0;
         int Ppid = pmt.getPCRPid();
-        int Apids[MAXAPIDS] = { 0 };
-        int Dpids[MAXDPIDS] = { 0 };
-        char ALangs[MAXAPIDS][4] = { "" };
-        char DLangs[MAXDPIDS][4] = { "" };
+        int Apids[MAXAPIDS + 1] = { 0 };
+        int Dpids[MAXDPIDS + 1] = { 0 };
+        char ALangs[MAXAPIDS + 1][4] = { "" };
+        char DLangs[MAXDPIDS + 1][4] = { "" };
         int Tpid = 0;
         int NumApids = 0;
         int NumDpids = 0;