Fixed a possible access of invalid file handles in cSIProcessor::Action()

3 files changed, 13 insertions, 3 deletions

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 9545f537..085dcb16 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -174,6 +174,7 @@ Stefan Huelswitt <huels@iname.com>
  for suggesting to add VDRVERSNUM to config.h
  for fixing a memory leak in cNonBlockingFileReader
  for fixing an uninitialized variable in cDisplayChannel
+ for fixing a possible access of invalid file handles in cSIProcessor::Action()
 
 Ulrich Röder <roeder@efr-net.de>
  for pointing out that there are channels that have a symbol rate higher than
diff --git a/HISTORY b/HISTORY
index e1dc2941..ef999259 100644
--- a/HISTORY
+++ b/HISTORY
@@ -2224,3 +2224,5 @@ Video Disk Recorder Revision History
 - Single event timers are now deleted if the recording they are doing is
   deleted before the timer ends.
 - Fixed an uninitialized variable in cDisplayChannel (thanks to Stefan Huelswitt).
+- Fixed a possible access of invalid file handles in cSIProcessor::Action()
+  (thanks to Stefan Huelswitt).
diff --git a/eit.c b/eit.c
index a5b14e76..99eb405f 100644
--- a/eit.c
+++ b/eit.c
@@ -16,7 +16,7 @@
  *   the Free Software Foundation; either version 2 of the License, or     *
  *   (at your option) any later version.                                   *
  *                                                                         *
- * $Id: eit.c 1.78 2003/05/18 14:10:25 kls Exp $
+ * $Id: eit.c 1.79 2003/05/29 15:04:10 kls Exp $
  ***************************************************************************/
 
 #include "eit.h"
@@ -1236,10 +1236,17 @@ void cSIProcessor::Action()
       // wait until data becomes ready from the bitfilter
       if (poll(pfd, NumUsedFilters, 1000) != 0)
       {
-         for (int a = 0; a < NumUsedFilters ; a++)
+         for (int aa = 0; aa < NumUsedFilters; aa++)
          {
-            if (pfd[a].revents & POLLIN)
+            if (pfd[aa].revents & POLLIN)
             {
+               int a;
+               for (a = 0; a < MAX_FILTERS; a++) {
+                   if (pfd[aa].fd == filters[a].handle)
+                      break;
+                   }
+               if (a >= MAX_FILTERS || !filters[a].inuse) // filter no longer available
+                  continue;
                // read section
                unsigned char buf[4096]; // max. allowed size for any EIT section
                int r = safe_read(filters[a].handle, buf, sizeof(buf));