summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKlaus Schmidinger <vdr@tvdr.de>2005-08-06 12:29:38 +0200
committerKlaus Schmidinger <vdr@tvdr.de>2005-08-06 12:29:38 +0200
commit16c3b8f0e7f3bd4ba5148e188806eae7ddcfaf08 (patch)
tree3dd6536b8fab9f8cdc826ab56a836731c3684108
parentff5df8f29852a1c968a2797e13e494ae882bed26 (diff)
downloadvdr-16c3b8f0e7f3bd4ba5148e188806eae7ddcfaf08.tar.gz
vdr-16c3b8f0e7f3bd4ba5148e188806eae7ddcfaf08.tar.bz2
Fixed an out-of-bounds memory access with audio language ids
-rw-r--r--CONTRIBUTORS4
-rw-r--r--HISTORY2
-rw-r--r--channels.c8
-rw-r--r--pat.c8
4 files changed, 15 insertions, 7 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 349d70de..f245754b 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -1248,6 +1248,7 @@ Udo Richter <udo_richter@gmx.de>
for reporting a problem in handling page up/down in menu lists in case there are
several non selectable items in a row
for fixing handling 'page down' after it was broken in version 1.3.26
+ for suggesting a fix for an out-of-bounds memory access with audio language ids
Sven Kreiensen <svenk@kammer.uni-hannover.de>
for his help in keeping 'channels.conf.terr' up to date
@@ -1402,3 +1403,6 @@ Henrik Niehaus <henrik.niehaus@gmx.de>
Martin Wache <M.Wache@gmx.net>
for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the
device, which avoids a busy loop on very fast machines
+
+Matthias Lenk <matthias.lenk@amd.com>
+ for reporting an out-of-bounds memory access with audio language ids
diff --git a/HISTORY b/HISTORY
index 6a3b25fd..e9e2518d 100644
--- a/HISTORY
+++ b/HISTORY
@@ -3657,3 +3657,5 @@ Video Disk Recorder Revision History
umask settings (thanks to Andreas Brachold).
- Fixed the cChannel copy constructor (thanks to Marcel Wiesweg for pointing out
a problem with it).
+- Fixed an out-of-bounds memory access with audio language ids (thanks to
+ Matthias Lenk for reporting, and Udo Richter for suggesting a fix).
diff --git a/channels.c b/channels.c
index 04f6dc98..85778526 100644
--- a/channels.c
+++ b/channels.c
@@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
- * $Id: channels.c 1.43 2005/08/06 12:06:37 kls Exp $
+ * $Id: channels.c 1.44 2005/08/06 12:22:41 kls Exp $
*/
#include "channels.h"
@@ -446,14 +446,16 @@ void cChannel::SetPids(int Vpid, int Ppid, int *Apids, char ALangs[][4], int *Dp
dsyslog("changing pids of channel %d from %d+%d:%s:%d to %d+%d:%s:%d", Number(), vpid, ppid, OldApidsBuf, tpid, Vpid, Ppid, NewApidsBuf, Tpid);
vpid = Vpid;
ppid = Ppid;
- for (int i = 0; i <= MAXAPIDS; i++) { // <= to copy the terminating 0
+ for (int i = 0; i < MAXAPIDS; i++) {
apids[i] = Apids[i];
strn0cpy(alangs[i], ALangs[i], 4);
}
- for (int i = 0; i <= MAXDPIDS; i++) { // <= to copy the terminating 0
+ apids[MAXAPIDS] = 0;
+ for (int i = 0; i < MAXDPIDS; i++) {
dpids[i] = Dpids[i];
strn0cpy(dlangs[i], DLangs[i], 4);
}
+ dpids[MAXDPIDS] = 0;
tpid = Tpid;
modification |= mod;
Channels.SetModified();
diff --git a/pat.c b/pat.c
index 356e28ef..e6b48cc1 100644
--- a/pat.c
+++ b/pat.c
@@ -4,7 +4,7 @@
* See the main source file 'vdr.c' for copyright information and
* how to reach the author.
*
- * $Id: pat.c 1.12 2005/01/25 21:02:11 kls Exp $
+ * $Id: pat.c 1.13 2005/08/06 12:23:51 kls Exp $
*/
#include "pat.h"
@@ -324,10 +324,10 @@ void cPatFilter::Process(u_short Pid, u_char Tid, const u_char *Data, int Length
SI::PMT::Stream stream;
int Vpid = 0;
int Ppid = pmt.getPCRPid();
- int Apids[MAXAPIDS + 1] = { 0 };
+ int Apids[MAXAPIDS + 1] = { 0 }; // these lists are zero-terminated
int Dpids[MAXDPIDS + 1] = { 0 };
- char ALangs[MAXAPIDS + 1][4] = { "" };
- char DLangs[MAXDPIDS + 1][4] = { "" };
+ char ALangs[MAXAPIDS][4] = { "" };
+ char DLangs[MAXDPIDS][4] = { "" };
int Tpid = 0;
int NumApids = 0;
int NumDpids = 0;