Skip to content

L
libdvbpsi
Commit b036dc2c authored by Jean-Paul Saman's avatar Jean-Paul Saman
Browse files
Options

dr_4a: add boundary check

parent c20edafa
Hide whitespace changes
Inline Side-by-side
Showing with 3 additions and 1 deletion
src/descriptors/dr_4a.c
View file @ b036dc2c
...@@ -123,6 +123,8 @@ dvbpsi_linkage_dr_t* dvbpsi_DecodeLinkageDr(dvbpsi_descriptor_t * p_descriptor) ...@@ -123,6 +123,8 @@ dvbpsi_linkage_dr_t* dvbpsi_DecodeLinkageDr(dvbpsi_descriptor_t * p_descriptor)
i = 10; i = 10;
} }
p_decoded->i_private_data_length = p_descriptor->i_length - i; p_decoded->i_private_data_length = p_descriptor->i_length - i;
if (p_decoded->i_private_data_length > 248)
p_decoded->i_private_data_length = 248;
memcpy(p_decoded->i_private_data, &p_descriptor->p_data[i], p_decoded->i_private_data_length); memcpy(p_decoded->i_private_data, &p_descriptor->p_data[i], p_decoded->i_private_data_length);
p_descriptor->p_decoded = (void*)p_decoded; p_descriptor->p_decoded = (void*)p_decoded;
...@@ -154,7 +156,7 @@ dvbpsi_descriptor_t * dvbpsi_GenLinkageDr(dvbpsi_linkage_dr_t * p_decoded, ...@@ -154,7 +156,7 @@ dvbpsi_descriptor_t * dvbpsi_GenLinkageDr(dvbpsi_linkage_dr_t * p_decoded,
if (p_decoded->i_linkage_type == 0x0D) if (p_decoded->i_linkage_type == 0x0D)
length+=3; length+=3;
if (length+p_decoded->i_private_data_length > 255) if (length+p_decoded->i_private_data_length > 255)
return NULL; return NULL;
/* Create the descriptor */ /* Create the descriptor */
dvbpsi_descriptor_t * p_descriptor = dvbpsi_descriptor_t * p_descriptor =
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment