frodovdr/vdr
1
0
Fork 0
mirror of https://github.com/VDR4Arch/vdr.git synced 2023-10-10 13:36:52 +02:00
Code Issues Releases Wiki Activity

Fixed a possible out of buffer memory access in case of bad TS data

Browse Source
This commit is contained in:
Klaus Schmidinger 2010-05-13 14:39:41 +02:00
parent e2a995f3e7
commit 539c0da853
4 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CONTRIBUTORS
View File

@ -1094,6 +1094,7 @@ Rolf Ahrenberg <rahrenbe@cc.hut.fi>
for keeping subtitles visible when pausing replay for keeping subtitles visible when pausing replay
for suggesting to assign the source character 'I' to "IPTV" for suggesting to assign the source character 'I' to "IPTV"
for fixing generating PMT language descriptors for multi language PIDs for fixing generating PMT language descriptors for multi language PIDs
for reporting a possible out of buffer memory access in case of bad TS data
Ralf Klueber <ralf.klueber@vodafone.com> Ralf Klueber <ralf.klueber@vodafone.com>
for reporting a bug in cutting a recording if there is only a single editing mark for reporting a bug in cutting a recording if there is only a single editing mark

2
HISTORY
View File

@ -6451,3 +6451,5 @@ Video Disk Recorder Revision History
- Fixed a crash when creating a new channel if the channel list is empty (reported - Fixed a crash when creating a new channel if the channel list is empty (reported
by Halim Sahin). by Halim Sahin).
- Updated the Czech OSD texts (thanks to Radek Stastny). - Updated the Czech OSD texts (thanks to Radek Stastny).
- Fixed a possible out of buffer memory access in case of bad TS data (reported
by Rolf Ahrenberg).

6
remux.c
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: remux.c 2.44 2010/04/18 13:40:20 kls Exp $ * $Id: remux.c 2.45 2010/05/13 14:16:56 kls Exp $
*/ */
#include "remux.h" #include "remux.h"
@ -663,6 +663,10 @@ void cTsToPes::PutTs(const uchar *Data, int Length)
if (length + Length > size) { if (length + Length > size) {
size = max(KILOBYTE(2), length + Length); size = max(KILOBYTE(2), length + Length);
data = (uchar *)realloc(data, size); data = (uchar *)realloc(data, size);
if (!data) {
Reset();
return;
}
} }
memcpy(data + length, Data, Length); memcpy(data + length, Data, Length);
length += Length; length += Length;

5
remux.h
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: remux.h 2.24 2010/01/29 16:51:26 kls Exp $ * $Id: remux.h 2.25 2010/05/13 14:29:45 kls Exp $
*/ */
#ifndef __REMUX_H #ifndef __REMUX_H
@ -84,7 +84,8 @@ inline bool TsIsScrambled(const uchar *p)
inline int TsPayloadOffset(const uchar *p) inline int TsPayloadOffset(const uchar *p)
{ {
return (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4; int o = (p[3] & TS_ADAPT_FIELD_EXISTS) ? p[4] + 5 : 4;
return o <= TS_SIZE ? o : TS_SIZE;
} }
inline int TsGetPayload(const uchar **p) inline int TsGetPayload(const uchar **p)