[linux-dvb] dvb_demux.c

[Ralph Metzler <rjkm@metzlerbros.de>]

Asier Aguirre writes:
 > [1  <text/plain; us-ascii (7bit)>]
 > Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line 
 > 269 (see patch) is not granted to be a positive value, yielding in a 
 > kernel segfault in the memcopy of line 292, and then hanging the system.
 > 
[...]
 > +++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c	2003-10-31 10:33:00.000000000 +0100
 > @@ -266,7 +266,7 @@
 >  		p += buf[p] + 1; 		// skip rest of last section
 >  		count = 188 - p;
 >  
 > -		while (count) {
 > +		while (count>0) {
 >  
 >  			sec->crc_val = ~0;
 >  

True, this has to be "count>0" and it actually always used to be.
Is this only wrong in the test9 kernel or also in other versions?


Ralph


-- 
Info:
To unsubscribe send a mail to ecartis@linuxtv.org with "unsubscribe linux-dvb" as subject.