Fixed cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond the end of the given buffer

4 files changed, 14 insertions, 5 deletions

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 000ed460..d6dfba1c 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -1079,6 +1079,9 @@ Marco Schlüßler <marco@lordzodiac.de>
  for fixing the cDvbSpuDecoder
  for fixing a short glitch when starting a recording on the primary device while
  in replay or transfer mode
+ for fixing cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond
+ the end of the given buffer, which has caused some unjustified "unknown picture
+ type errors"
 
 Jürgen Schmitz <j.schmitz@web.de>
  for reporting a bug in displaying the current channel when switching via the SVDRP
diff --git a/HISTORY b/HISTORY
index 019861a7..8ee0a494 100644
--- a/HISTORY
+++ b/HISTORY
@@ -3138,3 +3138,9 @@ Video Disk Recorder Revision History
   shot" and "repeating". The keys '1'...'7' can be used to toggle the individual
   days ('1' is monday). Thanks to Sascha Klek for reporting a problem with the
   '0' key in the "Day" item of the "Timers" menu.
+
+2004-11-16: Version 1.3.17
+
+- Fixed cRemux::ScanVideoPacket() to make sure it doesn't access memory beyond
+  the end of the given buffer, which has caused some unjustified "unknown
+  picture type errors" (thanks to Marco Schlüßler).
diff --git a/config.h b/config.h
index 955eb9f8..212f8781 100644
--- a/config.h
+++ b/config.h
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: config.h 1.204 2004/11/02 17:20:27 kls Exp $
+ * $Id: config.h 1.205 2004/11/16 16:57:43 kls Exp $
  */
 
 #ifndef __CONFIG_H
@@ -20,8 +20,8 @@
 #include "i18n.h"
 #include "tools.h"
 
-#define VDRVERSION  "1.3.16"
-#define VDRVERSNUM   10316  // Version * 10000 + Major * 100 + Minor
+#define VDRVERSION  "1.3.17"
+#define VDRVERSNUM   10317  // Version * 10000 + Major * 100 + Minor
 
 #define MAXPRIORITY 99
 #define MAXLIFETIME 99
diff --git a/remux.c b/remux.c
index e096f9cc..b9c04af3 100644
--- a/remux.c
+++ b/remux.c
@@ -8,7 +8,7 @@
  * the Linux DVB driver's 'tuxplayer' example and were rewritten to suit
  * VDR's needs.
  *
- * $Id: remux.c 1.21 2004/10/24 09:25:33 kls Exp $
+ * $Id: remux.c 1.22 2004/11/16 16:49:03 kls Exp $
  */
 
 #include "remux.h"
@@ -451,7 +451,7 @@ int cRemux::ScanVideoPacket(const uchar *Data, int Count, int Offset, uchar &Pic
      if (Length >= 8) {
         int i = Offset + 8; // the minimum length of the video packet header
         i += Data[i] + 1;   // possible additional header bytes
-        for (; i < Offset + Length; i++) {
+        for (; i < Offset + Length - 5; i++) {
             if (Data[i] == 0 && Data[i + 1] == 0 && Data[i + 2] == 1) {
                switch (Data[i + 3]) {
                  case SC_PICTURE: PictureType = (Data[i + 5] >> 3) & 0x07;