From 848c65fe4f56b95bf26035296f77b091a16ae704 Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Sat, 27 Jun 2020 10:05:56 +0200
Subject: [PATCH] Added CRC check of the CAT in cCaPidReceiver::Receive()

---
 CONTRIBUTORS |  1 +
 HISTORY      |  1 +
 ci.c         | 68 ++++++++++++++++++++++++++++------------------------
 3 files changed, 39 insertions(+), 31 deletions(-)

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 3ebeb1c7..31a662b6 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -3611,6 +3611,7 @@ Helmut Binder <cco@aon.at>
  for changing the country code in the generated ParentalRatingDescriptor from 'DEU' to
  '902' to make it valid for all countries
  for adjusting device selection in GetDeviceForTransponder() to that in GetDevice()
+ for adding CRC check of the CAT in cCaPidReceiver::Receive()
 
 Ulrich Eckhardt <uli@uli-eckhardt.de>
  for reporting a problem with shutdown after user inactivity in case a plugin is
diff --git a/HISTORY b/HISTORY
index a298f08d..60e73480 100644
--- a/HISTORY
+++ b/HISTORY
@@ -9490,3 +9490,4 @@ Video Disk Recorder Revision History
   to Helmut Binder).
 - Now adding CPPFLAGS to CXXFLAGS to allow extra preprocessor flags to be given when
   doing make (suggested by Tobisa Grimm).
+- Added CRC check of the CAT in cCaPidReceiver::Receive() (thanks to Helmut Binder).
diff --git a/ci.c b/ci.c
index 7d001a4f..2951273a 100644
--- a/ci.c
+++ b/ci.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: ci.c 4.28 2020/06/16 14:33:32 kls Exp $
+ * $Id: ci.c 4.29 2020/06/27 10:05:56 kls Exp $
  */
 
 #include "ci.h"
@@ -230,38 +230,44 @@ void cCaPidReceiver::Receive(const uchar *Data, int Length)
            }
         }
      if (p) {
-        DelEmmPids();
-        for (int i = 0; i < length - 4; i++) { // -4 = checksum
-            if (p[i] == 0x09) {
-               int CaId = int(p[i + 2] << 8) | p[i + 3];
-               int EmmPid = Peek13(p + i + 4);
-               AddEmmPid(EmmPid);
-               if (MtdCamSlot)
-                  MtdMapPid(const_cast<uchar *>(p + i + 4), MtdCamSlot->MtdMapper());
-               switch (CaId >> 8) {
-                 case 0x01: for (int j = i + 7; j < p[i + 1] + 2; j += 4) {
-                                EmmPid = Peek13(p + j);
-                                AddEmmPid(EmmPid);
-                                if (MtdCamSlot)
-                                   MtdMapPid(const_cast<uchar *>(p + j), MtdCamSlot->MtdMapper());
-                                }
-                            break;
-                 }
-               i += p[i + 1] + 2 - 1; // -1 to compensate for the loop increment
+        if (!SI::CRC32::crc32((const char *)p - 8, length + 8, 0xFFFFFFFF)) { // <TableIdCAT,....,crc32>
+           DelEmmPids();
+           for (int i = 0; i < length - 4; i++) { // -4 = checksum
+               if (p[i] == 0x09) {
+                  int CaId = int(p[i + 2] << 8) | p[i + 3];
+                  int EmmPid = Peek13(p + i + 4);
+                  AddEmmPid(EmmPid);
+                  if (MtdCamSlot)
+                     MtdMapPid(const_cast<uchar *>(p + i + 4), MtdCamSlot->MtdMapper());
+                  switch (CaId >> 8) {
+                    case 0x01: for (int j = i + 7; j < p[i + 1] + 2; j += 4) {
+                                   EmmPid = Peek13(p + j);
+                                   AddEmmPid(EmmPid);
+                                   if (MtdCamSlot)
+                                      MtdMapPid(const_cast<uchar *>(p + j), MtdCamSlot->MtdMapper());
+                                   }
+                               break;
+                    }
+                  i += p[i + 1] + 2 - 1; // -1 to compensate for the loop increment
+                  }
                }
-            }
-        if (MtdCamSlot) {
-           if (!bufp && length) {
-              // update crc32 - but only single packet CAT is handled for now:
-              uint32_t crc = SI::CRC32::crc32((const char *)p - 8, length + 8 - 4, 0xFFFFFFFF); // <TableIdCAT....>[crc32]
-              uchar *c = const_cast<uchar *>(p + length - 4);
-              *c++ = crc >> 24;
-              *c++ = crc >> 16;
-              *c++ = crc >> 8;
-              *c++ = crc;
+           if (MtdCamSlot) {
+              if (!bufp && length) {
+                 // update crc32 - but only single packet CAT is handled for now:
+                 uint32_t crc = SI::CRC32::crc32((const char *)p - 8, length + 8 - 4, 0xFFFFFFFF); // <TableIdCAT....>[crc32]
+                 uchar *c = const_cast<uchar *>(p + length - 4);
+                 *c++ = crc >> 24;
+                 *c++ = crc >> 16;
+                 *c++ = crc >> 8;
+                 *c++ = crc;
+                 }
+              memcpy(mtdCatBuffer, Data, TS_SIZE);
+              MtdCamSlot->PutCat(mtdCatBuffer, TS_SIZE);
               }
-           memcpy(mtdCatBuffer, Data, TS_SIZE);
-           MtdCamSlot->PutCat(mtdCatBuffer, TS_SIZE);
+           }
+        else {
+           esyslog("ERROR: wrong checksum in CAT");
+           catVersion = -1;
            }
         p = NULL;
         bufp = NULL;