From 2b29a5ce367d464fd10d6014990c881eccf5207e Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Sun, 19 Oct 2003 12:59:16 +0200
Subject: [PATCH] Improved cDvbDevice::StillPicture()

---
 HISTORY     |  4 ++++
 dvbdevice.c | 14 +++++++++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/HISTORY b/HISTORY
index 7c98c23f..7b738a29 100644
--- a/HISTORY
+++ b/HISTORY
@@ -2434,6 +2434,10 @@ Video Disk Recorder Revision History
 - Channel IDs are now checked when reading 'channels.conf' to avoid later
   problems with timers.
 
+2003-10-19: Version 1.2.6pre2
+
+- Improved cDvbDevice::StillPicture() (thanks to Thomas Heiligenmann).
+
 2003-10-18: Version 1.3.0
 
 - Changed thread handling to make it work with NPTL ("Native Posix Thread Library").
diff --git a/dvbdevice.c b/dvbdevice.c
index aed34931..4cbbc759 100644
--- a/dvbdevice.c
+++ b/dvbdevice.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: dvbdevice.c 1.68 2003/10/18 12:20:38 kls Exp $
+ * $Id: dvbdevice.c 1.69 2003/10/19 12:59:16 kls Exp $
  */
 
 #include "dvbdevice.h"
@@ -956,10 +956,14 @@ void cDvbDevice::StillPicture(const uchar *Data, int Length)
                  // skip header extension
                  if ((Data[i + 6] & 0xC0) == 0x80) {
                     // MPEG-2 PES header
+                    if (Data[i + 8] >= Length)
+                       break;
                     offs += 3;
                     offs += Data[i + 8];
                     len -= 3;
                     len -= Data[i + 8];
+                    if (len < 0 || offs + len >= Length)
+                       break;
                     }
                  else {
                     // MPEG-1 PES header
@@ -967,19 +971,19 @@ void cDvbDevice::StillPicture(const uchar *Data, int Length)
                           offs++;
                           len--;
                           }
-                    if ((Data[offs] & 0xC0) == 0x40) {
+                    if (offs <= Length - 2 && len >= 2 && (Data[offs] & 0xC0) == 0x40) {
                        offs += 2;
                        len -= 2;
                        }
-                    if ((Data[offs] & 0xF0) == 0x20) {
+                    if (offs <= Length - 5 && len >= 5 && (Data[offs] & 0xF0) == 0x20) {
                        offs += 5;
                        len -= 5;
                        }
-                    else if ((Data[offs] & 0xF0) == 0x30) {
+                    else if (offs <= Length - 10 && len >= 10 && (Data[offs] & 0xF0) == 0x30) {
                        offs += 10;
                        len -= 10;
                        }
-                    else if (Data[offs] == 0x0F) {
+                    else if (offs < Length && len > 0) {
                        offs++;
                        len--;
                        }