diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-01-05 14:50:58 +0000 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-01-05 14:50:58 +0000 |
| commit | 5347abe5764b0a0ff3ef1d357ce9934a425758fa (patch) | |
| tree | 16114922f1fe3862535ef1898da393648522d48b /src/input/input_pvr.c | |
| parent | 0907a74b5fa7b8b439f1f8f5db239c7586bfb12d (diff) | |
| parent | 8f725b5644ac910294fbe28929ddc98cd1d2ad38 (diff) | |
| download | xine-lib-5347abe5764b0a0ff3ef1d357ce9934a425758fa.tar.gz xine-lib-5347abe5764b0a0ff3ef1d357ce9934a425758fa.tar.bz2 | |
Merge security fixes.
Diffstat (limited to 'src/input/input_pvr.c')
| -rw-r--r-- | src/input/input_pvr.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/input/input_pvr.c b/src/input/input_pvr.c index 009c76939..18d29f6be 100644 --- a/src/input/input_pvr.c +++ b/src/input/input_pvr.c @@ -424,6 +424,9 @@ static uint32_t pvr_plugin_get_capabilities (input_plugin_t *this_gen) { static off_t pvr_plugin_read (input_plugin_t *this_gen, char *buf, off_t len) { /*pvr_input_plugin_t *this = (pvr_input_plugin_t *) this_gen;*/ + if (len < 4) + return -1; + /* FIXME: Tricking the demux_mpeg_block plugin */ buf[0] = 0; buf[1] = 0; @@ -1199,6 +1202,9 @@ static buf_element_t *pvr_plugin_read_block (input_plugin_t *this_gen, fifo_buff buf_element_t *buf; int speed = _x_get_speed(this->stream); + if (todo < 0 || todo > buf->size) + return NULL; + if( !this->pvr_running ) { xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, "input_pvr: thread died, aborting\n"); return NULL; |