diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2008-01-24 23:47:36 +0000 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2008-01-24 23:47:36 +0000 |
| commit | 6c456a0d597c2a96aadee33c7af5845de279e478 (patch) | |
| tree | 39c2ad0fa0e658997a5d6d61047d93096d533eae | |
| parent | b24d41f54d441f518c68c120b8ee1a2673bfbe0d (diff) | |
| download | xine-lib-6c456a0d597c2a96aadee33c7af5845de279e478.tar.gz xine-lib-6c456a0d597c2a96aadee33c7af5845de279e478.tar.bz2 | |
Fix a possible crash on channel change in the DVB plugin.
Some 0-sized sections were observed in the TS PMT parser.
Test setup details:
Test channel is Film 4 on Freeview.
Test hardware is a Nova-T Stick (older dib7000m variant).
Drivers from v4l-dvb hg, id a1c94c4a05f5, with dib7000m_set_frontend() patched
to select OUTMODE_HIGH_Z while tuning.
| -rw-r--r-- | ChangeLog | 1 | ||||
| -rw-r--r-- | src/demuxers/demux_ts.c | 9 |
2 files changed, 10 insertions, 0 deletions
@@ -11,6 +11,7 @@ xine-lib (1.1.10) (unreleased) * Sanity-check ASF header sizes. This fixes a crash in the ASF demuxer, caused by the example exploit given for CVE-2006-1664. * Don't discard audio samples forever. Fixed streaming playback. + * Fix a possible crash on channel change in the DVB plugin. xine-lib (1.1.9.1) 2008-01-11 * Security fixes: diff --git a/src/demuxers/demux_ts.c b/src/demuxers/demux_ts.c index 86a14f019..0fa0c971c 100644 --- a/src/demuxers/demux_ts.c +++ b/src/demuxers/demux_ts.c @@ -1193,6 +1193,15 @@ printf("Program Number is %i, looking for %i\n",program_number,this->program_num return; } + if (!section_length) { + free (this->pmt[program_count]); + this->pmt[program_count] = NULL; +#ifdef TS_PMT_LOG + printf ("ts_demux: eek, zero-length section?\n"); +#endif + return; + } + #ifdef TS_PMT_LOG printf ("ts_demux: have all TS packets for the PMT section\n"); #endif |