summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--CONTRIBUTORS1
-rw-r--r--HISTORY2
-rw-r--r--eit.c13
3 files changed, 13 insertions, 3 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 9545f537..085dcb16 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -174,6 +174,7 @@ Stefan Huelswitt <huels@iname.com>
for suggesting to add VDRVERSNUM to config.h
for fixing a memory leak in cNonBlockingFileReader
for fixing an uninitialized variable in cDisplayChannel
+ for fixing a possible access of invalid file handles in cSIProcessor::Action()
Ulrich Röder <roeder@efr-net.de>
for pointing out that there are channels that have a symbol rate higher than
diff --git a/HISTORY b/HISTORY
index e1dc2941..ef999259 100644
--- a/HISTORY
+++ b/HISTORY
@@ -2224,3 +2224,5 @@ Video Disk Recorder Revision History
- Single event timers are now deleted if the recording they are doing is
deleted before the timer ends.
- Fixed an uninitialized variable in cDisplayChannel (thanks to Stefan Huelswitt).
+- Fixed a possible access of invalid file handles in cSIProcessor::Action()
+ (thanks to Stefan Huelswitt).
diff --git a/eit.c b/eit.c
index a5b14e76..99eb405f 100644
--- a/eit.c
+++ b/eit.c
@@ -16,7 +16,7 @@
* the Free Software Foundation; either version 2 of the License, or *
* (at your option) any later version. *
* *
- * $Id: eit.c 1.78 2003/05/18 14:10:25 kls Exp $
+ * $Id: eit.c 1.79 2003/05/29 15:04:10 kls Exp $
***************************************************************************/
#include "eit.h"
@@ -1236,10 +1236,17 @@ void cSIProcessor::Action()
// wait until data becomes ready from the bitfilter
if (poll(pfd, NumUsedFilters, 1000) != 0)
{
- for (int a = 0; a < NumUsedFilters ; a++)
+ for (int aa = 0; aa < NumUsedFilters; aa++)
{
- if (pfd[a].revents & POLLIN)
+ if (pfd[aa].revents & POLLIN)
{
+ int a;
+ for (a = 0; a < MAX_FILTERS; a++) {
+ if (pfd[aa].fd == filters[a].handle)
+ break;
+ }
+ if (a >= MAX_FILTERS || !filters[a].inuse) // filter no longer available
+ continue;
// read section
unsigned char buf[4096]; // max. allowed size for any EIT section
int r = safe_read(filters[a].handle, buf, sizeof(buf));