Commit c20edafa authored by Jean-Paul Saman's avatar Jean-Paul Saman

dr_76: add boundary check

parent 3e838936
...@@ -64,7 +64,9 @@ dvbpsi_content_id_dr_t *dvbpsi_DecodeContentIdDr(dvbpsi_descriptor_t *p_descript ...@@ -64,7 +64,9 @@ dvbpsi_content_id_dr_t *dvbpsi_DecodeContentIdDr(dvbpsi_descriptor_t *p_descript
return NULL; return NULL;
p_decoded->i_number_of_entries = 0; p_decoded->i_number_of_entries = 0;
for (byte = 0; byte < p_descriptor->i_length; p_decoded->i_number_of_entries ++) for (byte = 0;
(byte < p_descriptor->i_length) && (p_decoded->i_number_of_entries < DVBPSI_CRID_ENTRY_DR_MAX);
p_decoded->i_number_of_entries ++)
{ {
dvbpsi_crid_entry_t *entry = &p_decoded->p_entries[p_decoded->i_number_of_entries]; dvbpsi_crid_entry_t *entry = &p_decoded->p_entries[p_decoded->i_number_of_entries];
......
...@@ -84,7 +84,14 @@ typedef struct dvbpsi_crid_entry_s ...@@ -84,7 +84,14 @@ typedef struct dvbpsi_crid_entry_s
uint8_t path[253]; /*!< content path */ uint8_t path[253]; /*!< content path */
uint16_t ref; /*!< content reference */ uint16_t ref; /*!< content reference */
} value; /*!< content specific value */ } value; /*!< content specific value */
}dvbpsi_crid_entry_t; } dvbpsi_crid_entry_t;
/*!
* \def DVBPSI_CRID_ENTRY_DR_MAX
* \brief Maximum number of dvbpsi_crid_entry_t entries present in
* @see dvbpsi_content_id_dr_t
*/
#define DVBPSI_CRID_ENTRY_DR_MAX 85
/***************************************************************************** /*****************************************************************************
* dvbpsi_content_id_dr_s * dvbpsi_content_id_dr_s
...@@ -102,8 +109,8 @@ typedef struct dvbpsi_crid_entry_s ...@@ -102,8 +109,8 @@ typedef struct dvbpsi_crid_entry_s
typedef struct dvbpsi_content_id_dr_s typedef struct dvbpsi_content_id_dr_s
{ {
uint8_t i_number_of_entries; /*!< Number of CRID entries present. */ uint8_t i_number_of_entries; /*!< Number of CRID entries present. */
dvbpsi_crid_entry_t p_entries[85];/*!< Array of CRID entries. */ dvbpsi_crid_entry_t p_entries[DVBPSI_CRID_ENTRY_DR_MAX];/*!< Array of CRID entries. */
}dvbpsi_content_id_dr_t; } dvbpsi_content_id_dr_t;
/***************************************************************************** /*****************************************************************************
* dvbpsi_DecodeLCNDr * dvbpsi_DecodeLCNDr
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment