[linux-dvb] AW: Re: Crashes in dvb_demux.c

["Florian Schirmer" <jolt@tuxbox.org>]

Hi,

>			if ((count>2) && // enough data to determine sec
length?
>			    ((sec->seclen = section_length(buf+p)) <=
count)) {
>				if (sec->seclen>4096) 

>buf+p contains 188 bytes or less (188-p), assuming p is positive.
>
>sec->seclen can contain up to 4096 bytes.

We'll check at the beginning (see above) wether sec->seclen is smaller that
the payload bytes of buf+p. Only if that is true this code path will be
used. (Section is smaller than a TS packet). At least this part looks safe
to me ;-)

Bye,
  Florian




-- 
Info:
To unsubscribe send a mail to listar@linuxtv.org with "unsubscribe linux-dvb" as subject.