From 8db58ff99e815ebb42408a30bf84002bb7ee08dc Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Sun, 4 Dec 2011 15:09:45 +0100
Subject: [PATCH] Fixed a crash with malformed SI data

---
 HISTORY    | 1 +
 libsi/si.c | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/HISTORY b/HISTORY
index 5f04f569..c74c1a07 100644
--- a/HISTORY
+++ b/HISTORY
@@ -6779,3 +6779,4 @@ Video Disk Recorder Revision History
   to Ville Skyttä).
 - Added file name and line number to LOG_ERROR_STR() (thanks to Rolf Ahrenberg).
 - Replaced all calls to sleep() with cCondWait::SleepMs() (thanks to Rolf Ahrenberg).
+- Fixed a crash with malformed SI data (patch from vdr-portal).
diff --git a/libsi/si.c b/libsi/si.c
index 840b3a1f..82123e17 100644
--- a/libsi/si.c
+++ b/libsi/si.c
@@ -6,7 +6,7 @@
  *   the Free Software Foundation; either version 2 of the License, or     *
  *   (at your option) any later version.                                   *
  *                                                                         *
- *   $Id: si.c 2.4 2011/06/15 21:26:00 kls Exp $
+ *   $Id: si.c 2.5 2011/12/04 15:06:18 kls Exp $
  *                                                                         *
  ***************************************************************************/
 
@@ -206,6 +206,8 @@ void DescriptorGroup::Add(GroupDescriptor *d) {
          array[i]=0;
    } else if (length != d->getLastDescriptorNumber()+1)
       return; //avoid crash in case of misuse
+   if (length <= d->getDescriptorNumber())
+      return; // see http://www.vdr-portal.de/board60-linux/board14-betriebssystem/board69-c-t-vdr/p1025777-segfault-mit-vdr-1-7-21/#post1025777
    array[d->getDescriptorNumber()]=d;
 }