Fixed an out-of-bounds memory access with audio language ids

4 files changed, 15 insertions, 7 deletions

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 349d70de..f245754b 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -1248,6 +1248,7 @@ Udo Richter <udo_richter@gmx.de>
  for reporting a problem in handling page up/down in menu lists in case there are
  several non selectable items in a row
  for fixing handling 'page down' after it was broken in version 1.3.26
+ for suggesting a fix for an out-of-bounds memory access with audio language ids
 
 Sven Kreiensen <svenk@kammer.uni-hannover.de>
  for his help in keeping 'channels.conf.terr' up to date
@@ -1402,3 +1403,6 @@ Henrik Niehaus <henrik.niehaus@gmx.de>
 Martin Wache <M.Wache@gmx.net>
  for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the
  device, which avoids a busy loop on very fast machines
+
+Matthias Lenk <matthias.lenk@amd.com>
+ for reporting an out-of-bounds memory access with audio language ids
diff --git a/HISTORY b/HISTORY
index 6a3b25fd..e9e2518d 100644
--- a/HISTORY
+++ b/HISTORY
@@ -3657,3 +3657,5 @@ Video Disk Recorder Revision History
   umask settings (thanks to Andreas Brachold).
 - Fixed the cChannel copy constructor (thanks to Marcel Wiesweg for pointing out
   a problem with it).
+- Fixed an out-of-bounds memory access with audio language ids (thanks to
+  Matthias Lenk for reporting, and Udo Richter for suggesting a fix).
diff --git a/channels.c b/channels.c
index 04f6dc98..85778526 100644
--- a/channels.c
+++ b/channels.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: channels.c 1.43 2005/08/06 12:06:37 kls Exp $
+ * $Id: channels.c 1.44 2005/08/06 12:22:41 kls Exp $
  */
 
 #include "channels.h"
@@ -446,14 +446,16 @@ void cChannel::SetPids(int Vpid, int Ppid, int *Apids, char ALangs[][4], int *Dp
      dsyslog("changing pids of channel %d from %d+%d:%s:%d to %d+%d:%s:%d", Number(), vpid, ppid, OldApidsBuf, tpid, Vpid, Ppid, NewApidsBuf, Tpid);
      vpid = Vpid;
      ppid = Ppid;
-     for (int i = 0; i <= MAXAPIDS; i++) { // <= to copy the terminating 0
+     for (int i = 0; i < MAXAPIDS; i++) {
          apids[i] = Apids[i];
          strn0cpy(alangs[i], ALangs[i], 4);
          }
-     for (int i = 0; i <= MAXDPIDS; i++) { // <= to copy the terminating 0
+     apids[MAXAPIDS] = 0;
+     for (int i = 0; i < MAXDPIDS; i++) {
          dpids[i] = Dpids[i];
          strn0cpy(dlangs[i], DLangs[i], 4);
          }
+     dpids[MAXDPIDS] = 0;
      tpid = Tpid;
      modification |= mod;
      Channels.SetModified();
diff --git a/pat.c b/pat.c
index 356e28ef..e6b48cc1 100644
--- a/pat.c
+++ b/pat.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: pat.c 1.12 2005/01/25 21:02:11 kls Exp $
+ * $Id: pat.c 1.13 2005/08/06 12:23:51 kls Exp $
  */
 
 #include "pat.h"
@@ -324,10 +324,10 @@ void cPatFilter::Process(u_short Pid, u_char Tid, const u_char *Data, int Length
         SI::PMT::Stream stream;
         int Vpid = 0;
         int Ppid = pmt.getPCRPid();
-        int Apids[MAXAPIDS + 1] = { 0 };
+        int Apids[MAXAPIDS + 1] = { 0 }; // these lists are zero-terminated
         int Dpids[MAXDPIDS + 1] = { 0 };
-        char ALangs[MAXAPIDS + 1][4] = { "" };
-        char DLangs[MAXDPIDS + 1][4] = { "" };
+        char ALangs[MAXAPIDS][4] = { "" };
+        char DLangs[MAXDPIDS][4] = { "" };
         int Tpid = 0;
         int NumApids = 0;
         int NumDpids = 0;