[linux-dvb] Crashes in dvb_demux.c

[Ralph Metzler <rjkm@metzlerbros.de>]

Emard writes:
 > void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 > {
 >         struct dvb_demux_feed *feed = demux->pid2feed[ts_pid(buf)];
 > 
 >         if (!feed)
 >                 return;
 > 
 >         dvb_dmx_swfilter_packet_type (feed, buf);
 > }
 > 
 > Simple, but crashable in the very first line. The crash is:


I don't know exactly why it crashes for you (your dump rather
points to an out of bounds *buf I think) but ts_pid() can only return values
<=0x1fff. There should be no check needed.



 >  	spin_lock(&demux->lock);
 >  
 > -	if ((feed = demux->pid2feed[0x2000]))
 > +	if ((feed = demux->pid2feed[DMX_MAX_PID]))
 >  		feed->cb.ts(buf, count*188, 0, 0, &feed->feed.ts, DMX_OK); 


This has to be 0x2000 which stands for "get the complete TS".
DMX_MAX_PID might change if you want other "special PIDs" in the future.
Better do something like:

#define DMX_FULL_TS_PID 0x2000

and use that.


Ralph


-- 
Info:
To unsubscribe send a mail to listar@linuxtv.org with "unsubscribe linux-dvb" as subject.