frodovdr
/
vdr
mirror of https://github.com/VDR4Arch/vdr.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fixed a possible out of buffer memory access in case of bad TS data

This commit is contained in:
Klaus Schmidinger 2010-05-13 14:39:41 +02:00
parent e2a995f3e7
commit 539c0da853
4 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CONTRIBUTORS
View File

@ -1094,6 +1094,7 @@ Rolf Ahrenberg <rahrenbe@cc.hut.fi>
for keeping subtitles visible when pausing replay
for suggesting to assign the source character 'I' to "IPTV"
for fixing generating PMT language descriptors for multi language PIDs
for reporting a possible out of buffer memory access in case of bad TS data
Ralf Klueber <ralf.klueber@vodafone.com>
for reporting a bug in cutting a recording if there is only a single editing mark

2
HISTORY
View File

@ -6451,3 +6451,5 @@ Video Disk Recorder Revision History
- Fixed a crash when creating a new channel if the channel list is empty (reported
by Halim Sahin).
- Updated the Czech OSD texts (thanks to Radek Stastny).
- Fixed a possible out of buffer memory access in case of bad TS data (reported
by Rolf Ahrenberg).

6
remux.c
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
* $Id: remux.c 2.44 2010/04/18 13:40:20 kls Exp $
* $Id: remux.c 2.45 2010/05/13 14:16:56 kls Exp $
*/
#include "remux.h"
@ -663,6 +663,10 @@ void cTsToPes::PutTs(const uchar *Data, int Length)
if (length + Length > size) {
size = max(KILOBYTE(2), length + Length);
data = (uchar *)realloc(data, size);
if (!data) {
Reset();
return;
}
}
memcpy(data + length, Data, Length);
length += Length;

5
remux.h
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
* $Id: remux.h 2.24 2010/01/29 16:51:26 kls Exp $
* $Id: remux.h 2.25 2010/05/13 14:29:45 kls Exp $
*/
#ifndef __REMUX_H
@ -84,7 +84,8 @@ inline bool TsIsScrambled(const uchar *p)
inline int TsPayloadOffset(const uchar *p)
{
return (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4;
int o = (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4;
return o <= TS_SIZE ? o : TS_SIZE;
}
inline int TsGetPayload(const uchar **p)