Fix a possible DVB plugin crash when switching channels.

section_length is sometimes 0; this leads to the CRC32 calculation being
performed with a data length of -1 bytes, a.k.a. 4294967295 bytes.
(Reported by Johannes Zellner.)

--HG--
extra : transplant_source : %B6m%D0%0C%84%DA%40%C3%0B%06%11%B1%11%9El%A8%1F%95%27%E5

2 files changed, 4 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index ae091a7f0..23ca358e8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,7 @@ xine-lib (1.1.9) (unreleased)
   * Implemented decoding of XML character entities with codes >= 256.
     This requires conversion to UTF-8 of entities with codes >= 128.
   * Fixed ATSC support. [Bug 1749508]
+  * Fixed a possible DVB plugin crash when switching channels.
 
 xine-lib (1.1.8)
   * Send a channel-changed event to the frontend when receiving the SYNC
diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c
index 3ed6bcecd..86a14f019 100644
--- a/src/demuxers/demux_ts.c
+++ b/src/demuxers/demux_ts.c
@@ -369,8 +369,8 @@ static void demux_ts_build_crc32_table(demux_ts_t*this) {
 }
 
 static uint32_t demux_ts_compute_crc32(demux_ts_t*this, uint8_t *data, 
-				       uint32_t length, uint32_t crc32) {
-  uint32_t i;
+				       int32_t length, uint32_t crc32) {
+  int32_t i;
 
   for(i = 0; i < length; i++) {
     crc32 = (crc32 << 8) ^ this->crc32_table[(crc32 >> 24) ^ data[i]];
@@ -521,7 +521,7 @@ static void demux_ts_parse_pat (demux_ts_t*this, unsigned char *original_pkt,
                                 unsigned char *pkt, unsigned int pusi) {
   uint32_t       table_id;
   uint32_t       section_syntax_indicator;
-  uint32_t       section_length;
+  int32_t        section_length;
   uint32_t       transport_stream_id;
   uint32_t       version_number;
   uint32_t       current_next_indicator;