From e18918ad06c0b3ba78e4eb0ec136a3911dff9633 Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Sat, 24 Feb 2001 12:12:58 +0100
Subject: [PATCH] Fixed an occasional segfault in the EIT processor

---
 HISTORY |  3 ++-
 eit.c   | 13 +++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/HISTORY b/HISTORY
index e6fd496b..883e46a1 100644
--- a/HISTORY
+++ b/HISTORY
@@ -350,7 +350,7 @@ Video Disk Recorder Revision History
 - Encrypted channels can now be selected even without knowing the PNR (however, it
   is still necessary for the EPG info).
 
-2001-02-19: Version 0.71
+2001-02-24: Version 0.71
 
 - Fixed 'Transfer Mode' in cases where a non-primary interface was switched to
   a channel that only the primary interface can receive (which could happen in
@@ -401,3 +401,4 @@ Video Disk Recorder Revision History
   in file names (VFAT can't handle them). Do 'make VFAT=1' to enable this.
 - Support for DVB-C (thanks to Hans-Peter Raschke and Peter Hofmann).
   See the INSTALL file for more information about the use of VDR with cable.
+- Fixed an occasional segfault in the EIT processor.
diff --git a/eit.c b/eit.c
index e7c60c16..08588b06 100644
--- a/eit.c
+++ b/eit.c
@@ -13,7 +13,7 @@
  *   the Free Software Foundation; either version 2 of the License, or     *
  *   (at your option) any later version.                                   *
  *                                                                         *
- * $Id: eit.c 1.11 2000/12/03 15:33:37 kls Exp $
+ * $Id: eit.c 1.12 2001/02/24 12:12:58 kls Exp $
  ***************************************************************************/
 
 #include "eit.h"
@@ -851,7 +851,8 @@ int cEIT::ProcessEIT()
 					break;
 	
 				case EIT_COMPONENT_DESCRIPTOR	:
-					strdvbcpy(tmp, &buffer[bufact + 8], buffer[bufact + 1] - 6);
+               if (buffer[bufact + 1] > 6) // kls 2001-02-24: otherwise strncpy() causes a segfault in strdvbcpy()
+					   strdvbcpy(tmp, &buffer[bufact + 8], buffer[bufact + 1] - 6);
 					//dsyslog(LOG_INFO, "Found EIT_COMPONENT_DESCRIPTOR %c%c%c 0x%02x/0x%02x/0x%02x '%s'\n", buffer[bufact + 5], buffer[bufact + 6], buffer[bufact + 7], buffer[2], buffer[3], buffer[4], tmp);
 					break;
 	
@@ -910,6 +911,14 @@ int cEIT::strdvbcpy(unsigned char *dst, unsigned char *src, int max)
 {
 	int a = 0;
 	
+   // kls 2001-02-24: if we come in with negative values, the caller must
+   // have done something wrong and the strncpy() below will cause a segfault
+   if (max <= 0)
+   {
+      *dst = 0;
+      return 0;
+   }
+
 	if (*src == 0x05 || (*src >= 0x20 && *src <= 0xff))
 	{
 		for (a = 0; a < max; a++)