Fixed a possible crash with inconsistent SI data

1 files changed, 13 insertions, 7 deletions

diff --git a/libsi/si.c b/libsi/si.c
index 40f94539..20ca1b7a 100644
--- a/libsi/si.c
+++ b/libsi/si.c
@@ -6,7 +6,7 @@
  *   the Free Software Foundation; either version 2 of the License, or     *
  *   (at your option) any later version.                                   *
  *                                                                         *
- *   $Id: si.c 1.11 2004/06/06 14:43:56 kls Exp $
+ *   $Id: si.c 1.12 2004/10/16 09:54:05 kls Exp $
  *                                                                         *
  ***************************************************************************/
 
@@ -30,6 +30,10 @@ void Object::setData(CharArray &d) {
    data=d;
 }
 
+bool Object::checkSize(unsigned int offset) {
+   return data.checkSize(offset);
+}
+
 Section::Section(const unsigned char *data, bool doCopy) {
    setData(data, getLength(data), doCopy);
 }
@@ -50,15 +54,15 @@ int Section::getLength(const unsigned char *d) {
    return HILO(((const SectionHeader *)d)->section_length)+sizeof(SectionHeader);
 }
 
-bool CRCSection::isValid() {
+bool CRCSection::isCRCValid() {
    return CRC32::isValid((const char *)data.getData(), getLength()/*, data.FourBytes(getLength()-4)*/);
 }
 
 bool CRCSection::CheckCRCAndParse() {
-   if (!isValid())
+   if (!isCRCValid())
       return false;
    CheckParse();
-   return true;
+   return isValid();
 }
 
 int NumberedSection::getTableIdExtension() const {
@@ -102,7 +106,7 @@ DescriptorTag Descriptor::getDescriptorTag(const unsigned char *d) {
 }
 
 Descriptor *DescriptorLoop::getNext(Iterator &it) {
-   if (it.i<getLength()) {
+   if (isValid() && it.i<getLength()) {
       return createDescriptor(it.i, true);
    }
    return 0;
@@ -110,7 +114,7 @@ Descriptor *DescriptorLoop::getNext(Iterator &it) {
 
 Descriptor *DescriptorLoop::getNext(Iterator &it, DescriptorTag tag, bool returnUnimplemetedDescriptor) {
    Descriptor *d=0;
-   if (it.i<getLength()) {
+   if (isValid() && it.i<getLength()) {
       const unsigned char *p=data.getData(it.i);
       const unsigned char *end=p+getLength()-it.i;
       while (p < end) {
@@ -128,7 +132,7 @@ Descriptor *DescriptorLoop::getNext(Iterator &it, DescriptorTag tag, bool return
 
 Descriptor *DescriptorLoop::getNext(Iterator &it, DescriptorTag *tags, int arrayLength, bool returnUnimplementedDescriptor) {
    Descriptor *d=0;
-   if (it.i<getLength()) {
+   if (isValid() && it.i<getLength()) {
       const unsigned char *p=data.getData(it.i);
       const unsigned char *end=p+getLength()-it.i;
       while (p < end) {
@@ -147,6 +151,8 @@ Descriptor *DescriptorLoop::getNext(Iterator &it, DescriptorTag *tags, int array
 }
 
 Descriptor *DescriptorLoop::createDescriptor(int &i, bool returnUnimplemetedDescriptor) {
+   if (!checkSize(Descriptor::getLength(data.getData(i))))
+      return 0;
    Descriptor *d=Descriptor::getDescriptor(data+i, domain, returnUnimplemetedDescriptor);
    if (!d)
       return 0;