diff options
| -rw-r--r-- | CONTRIBUTORS | 4 | ||||
| -rw-r--r-- | HISTORY | 2 | ||||
| -rw-r--r-- | channels.c | 8 | ||||
| -rw-r--r-- | pat.c | 8 |
4 files changed, 15 insertions, 7 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS index 349d70de..f245754b 100644 --- a/CONTRIBUTORS +++ b/CONTRIBUTORS @@ -1248,6 +1248,7 @@ Udo Richter <udo_richter@gmx.de> for reporting a problem in handling page up/down in menu lists in case there are several non selectable items in a row for fixing handling 'page down' after it was broken in version 1.3.26 + for suggesting a fix for an out-of-bounds memory access with audio language ids Sven Kreiensen <svenk@kammer.uni-hannover.de> for his help in keeping 'channels.conf.terr' up to date @@ -1402,3 +1403,6 @@ Henrik Niehaus <henrik.niehaus@gmx.de> Martin Wache <M.Wache@gmx.net> for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the device, which avoids a busy loop on very fast machines + +Matthias Lenk <matthias.lenk@amd.com> + for reporting an out-of-bounds memory access with audio language ids @@ -3657,3 +3657,5 @@ Video Disk Recorder Revision History umask settings (thanks to Andreas Brachold). - Fixed the cChannel copy constructor (thanks to Marcel Wiesweg for pointing out a problem with it). +- Fixed an out-of-bounds memory access with audio language ids (thanks to + Matthias Lenk for reporting, and Udo Richter for suggesting a fix). @@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: channels.c 1.43 2005/08/06 12:06:37 kls Exp $ + * $Id: channels.c 1.44 2005/08/06 12:22:41 kls Exp $ */ #include "channels.h" @@ -446,14 +446,16 @@ void cChannel::SetPids(int Vpid, int Ppid, int *Apids, char ALangs[][4], int *Dp dsyslog("changing pids of channel %d from %d+%d:%s:%d to %d+%d:%s:%d", Number(), vpid, ppid, OldApidsBuf, tpid, Vpid, Ppid, NewApidsBuf, Tpid); vpid = Vpid; ppid = Ppid; - for (int i = 0; i <= MAXAPIDS; i++) { // <= to copy the terminating 0 + for (int i = 0; i < MAXAPIDS; i++) { apids[i] = Apids[i]; strn0cpy(alangs[i], ALangs[i], 4); } - for (int i = 0; i <= MAXDPIDS; i++) { // <= to copy the terminating 0 + apids[MAXAPIDS] = 0; + for (int i = 0; i < MAXDPIDS; i++) { dpids[i] = Dpids[i]; strn0cpy(dlangs[i], DLangs[i], 4); } + dpids[MAXDPIDS] = 0; tpid = Tpid; modification |= mod; Channels.SetModified(); @@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: pat.c 1.12 2005/01/25 21:02:11 kls Exp $ + * $Id: pat.c 1.13 2005/08/06 12:23:51 kls Exp $ */ #include "pat.h" @@ -324,10 +324,10 @@ void cPatFilter::Process(u_short Pid, u_char Tid, const u_char *Data, int Length SI::PMT::Stream stream; int Vpid = 0; int Ppid = pmt.getPCRPid(); - int Apids[MAXAPIDS + 1] = { 0 }; + int Apids[MAXAPIDS + 1] = { 0 }; // these lists are zero-terminated int Dpids[MAXDPIDS + 1] = { 0 }; - char ALangs[MAXAPIDS + 1][4] = { "" }; - char DLangs[MAXDPIDS + 1][4] = { "" }; + char ALangs[MAXAPIDS][4] = { "" }; + char DLangs[MAXDPIDS][4] = { "" }; int Tpid = 0; int NumApids = 0; int NumDpids = 0; |