Commit c833e5a7 authored by Michael Krufky's avatar Michael Krufky Committed by Jean-Paul Saman

dr_a1: check the descriptor length before allocating p_decoded

Signed-off-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
parent 6f8a84a6
...@@ -59,6 +59,10 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr( ...@@ -59,6 +59,10 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr(
if(p_descriptor->p_decoded) if(p_descriptor->p_decoded)
return p_descriptor->p_decoded; return p_descriptor->p_decoded;
/* Check length */
if((p_descriptor->i_length - 3) % 6)
return NULL;
/* Allocate memory */ /* Allocate memory */
p_decoded = p_decoded =
(dvbpsi_service_location_dr_t*)malloc(sizeof(dvbpsi_service_location_dr_t)); (dvbpsi_service_location_dr_t*)malloc(sizeof(dvbpsi_service_location_dr_t));
...@@ -66,13 +70,6 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr( ...@@ -66,13 +70,6 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr(
memset(p_decoded, 0, sizeof(dvbpsi_service_location_dr_t)); memset(p_decoded, 0, sizeof(dvbpsi_service_location_dr_t));
/* Decode data and check the length */
if(p_descriptor->i_length < 3)
{
free(p_decoded);
return NULL;
}
p_descriptor->p_decoded = (void*)p_decoded; p_descriptor->p_decoded = (void*)p_decoded;
p_decoded->i_pcr_pid = dvbpsi_get_bits(buf, 3, 13); p_decoded->i_pcr_pid = dvbpsi_get_bits(buf, 3, 13);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment