[linux-dvb] Re: dvb_demux.c

[Johannes Stezenbach <js@convergence.de>]

Ralph Metzler wrote:
> Asier Aguirre writes:
>  > [1  <text/plain; us-ascii (7bit)>]
>  > Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line 
>  > 269 (see patch) is not granted to be a positive value, yielding in a 
>  > kernel segfault in the memcopy of line 292, and then hanging the system.
>  > 
> [...]
>  > +++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c	2003-10-31 10:33:00.000000000 +0100
>  > @@ -266,7 +266,7 @@
>  >  		p += buf[p] + 1; 		// skip rest of last section
>  >  		count = 188 - p;
>  >  
>  > -		while (count) {
>  > +		while (count>0) {
>  >  
>  >  			sec->crc_val = ~0;
>  >  
> 
> True, this has to be "count>0" and it actually always used to be.
> Is this only wrong in the test9 kernel or also in other versions?

Funny, this happend in a "cleanup" in Nov. 2002.
Currected in dvb-kernel and DVB CVS now.

Thanks,
johannes


-- 
Info:
To unsubscribe send a mail to ecartis@linuxtv.org with "unsubscribe linux-dvb" as subject.