[linux-dvb] dvb_demux.c

[Asier Aguirre <aaguirre@indra.es>]

Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line 
269 (see patch) is not granted to be a positive value, yielding in a 
kernel segfault in the memcopy of line 292, and then hanging the system.

Asier Aguirre
-------------------------------------------------------------------------------------------------------------------
Este correo electrónico y, en su caso, cualquier fichero anexo al mismo, contiene información de carácter confidencial exclusivamente dirigida a su destinatario o destinatarios. Queda prohibida su divulgación, copia o distribución a terceros sin la previa autorización escrita de Indra. En el caso de haber recibido este correo electrónico por error, se ruega notificar inmediatamente esta circunstancia mediante reenvío a la dirección electrónica del remitente.

The information in this e-mail and in any attachments is confidential and solely for the attention and use of the named addressee(s). You are hereby notified that any dissemination, distribution or copy of this communication is prohibited without the prior written consent of Indra. If you have received this communication in error, please, notify the sender by reply e-mail
diff -ur linux-2.6.0-test9/drivers/media/dvb/dvb-core/dvb_demux.c linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c
--- linux-2.6.0-test9/drivers/media/dvb/dvb-core/dvb_demux.c	2003-10-31 10:22:14.000000000 +0100
+++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c	2003-10-31 10:33:00.000000000 +0100
@@ -266,7 +266,7 @@
 		p += buf[p] + 1; 		// skip rest of last section
 		count = 188 - p;
 
-		while (count) {
+		while (count>0) {
 
 			sec->crc_val = ~0;