frodovdr/vdr
1
0
Fork 0
mirror of https://github.com/VDR4Arch/vdr.git synced 2023-10-10 13:36:52 +02:00
Code Issues Releases Wiki Activity

Added a check to avoid a possible NULL pointer dereference in cCiSession::SendData()

Browse Source
This commit is contained in:
Klaus Schmidinger 2013-12-29 17:20:22 +01:00
parent 00e2415b81
commit 63ee17701a
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CONTRIBUTORS
View File

@ -2035,6 +2035,7 @@ Ville Skytt
displayed displayed
for fixing some spellings in positioner.h and Doxyfile for fixing some spellings in positioner.h and Doxyfile
for changing '%a' to the POSIX compliant '%m' in all scanf() calls for changing '%a' to the POSIX compliant '%m' in all scanf() calls
for reporting a possible NULL pointer dereference in cCiSession::SendData()
Steffen Beyer <cpunk@reactor.de> Steffen Beyer <cpunk@reactor.de>
for fixing setting the colored button help after deleting a recording in case the next for fixing setting the colored button help after deleting a recording in case the next

4
HISTORY
View File

@ -8032,7 +8032,7 @@ Video Disk Recorder Revision History
the last replayed recording (if any) by pressing Ok repeatedly in the Recordings the last replayed recording (if any) by pressing Ok repeatedly in the Recordings
menu. menu.
2013-12-28: Version 2.1.3 2013-12-29: Version 2.1.3
- Changed the return value of cPositioner::HorizonLongitude() to 0 in case the - Changed the return value of cPositioner::HorizonLongitude() to 0 in case the
latitude of the antenna location is beyond +/-81 degrees. latitude of the antenna location is beyond +/-81 degrees.
@ -8097,3 +8097,5 @@ Video Disk Recorder Revision History
- cTSBuffer now provides the number of available bytes in its Get() function. - cTSBuffer now provides the number of available bytes in its Get() function.
- cDvbDevice::GetTSPacket() now calls CamSlot()->Decrypt() in order to allow CAM slots - cDvbDevice::GetTSPacket() now calls CamSlot()->Decrypt() in order to allow CAM slots
that can be freely assigned to any device access to the TS data stream. that can be freely assigned to any device access to the TS data stream.
- Added a check to avoid a possible NULL pointer dereference in cCiSession::SendData()
(reported by Ville Skyttä).

3
ci.c
View File

@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and * See the main source file 'vdr.c' for copyright information and
* how to reach the author. * how to reach the author.
* *
* $Id: ci.c 3.1 2013/12/28 11:57:51 kls Exp $ * $Id: ci.c 3.2 2013/12/29 15:51:08 kls Exp $
*/ */
#include "ci.h" #include "ci.h"
@ -403,6 +403,7 @@ void cCiSession::SendData(int Tag, int Length, const uint8_t *Data)
*p++ = Tag & 0xFF; *p++ = Tag & 0xFF;
p = SetLength(p, Length); p = SetLength(p, Length);
if (p - buffer + Length < int(sizeof(buffer))) { if (p - buffer + Length < int(sizeof(buffer))) {
if (Data)
memcpy(p, Data, Length); memcpy(p, Data, Length);
p += Length; p += Length;
tc->SendData(p - buffer, buffer); tc->SendData(p - buffer, buffer);