[vdr] Re: Nasty bug in StillPicture()

[Thomas Heiligenmann <thomas@heiligenmann.de>]

Klaus Schmidinger schrieb:

<snip>

> >  ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> > --- dvbdevice.c.orig    2003-09-06 15:19:33.000000000 +0200
> > +++ dvbdevice.c 2003-10-18 14:03:39.000000000 +0200
> > ...
>
> Please make patches against (and test with) version 1.2.6pre1, which I have made
> available today.
Oops - just seen it. Here comes the updated patch :-)


Thomas
--- dvbdevice.c.orig	2003-10-17 17:36:13.000000000 +0200
+++ dvbdevice.c	2003-10-18 14:53:12.000000000 +0200
@@ -955,7 +955,7 @@
                  // skip PES header
                  int offs = i + 6;
                  // skip header extension
-                 if ((Data[i + 6] & 0xC0) == 0x80) {
+                 if (offs <= Length - Data[i + 8] && len >= Data[i + 8] && (Data[i + 6] & 0xC0) == 0x80) {
                     // MPEG-2 PES header
                     offs += 3;
                     offs += Data[i + 8];
@@ -968,19 +968,19 @@
                           offs++;
                           len--;
                           }
-                    if ((Data[offs] & 0xC0) == 0x40) {
+                    if (offs <= Length - 2 && len >= 2 && (Data[offs] & 0xC0) == 0x40) {
                        offs += 2;
                        len -= 2;
                        }
-                    if ((Data[offs] & 0xF0) == 0x20) {
+                    if (offs <= Length - 5 && len >= 5 && (Data[offs] & 0xF0) == 0x20) {
                        offs += 5;
                        len -= 5;
                        }
-                    else if ((Data[offs] & 0xF0) == 0x30) {
+                    else if (offs <= Length - 10 && len >= 10 && (Data[offs] & 0xF0) == 0x30) {
                        offs += 10;
                        len -= 10;
                        }
-                    else if (Data[offs] == 0x0F) {
+                    else if (offs < Length && len > 0) {
                        offs++;
                        len--;
                        }