From a0b9021d54dc9890da5f0c9bd26361db4556f6c2 Mon Sep 17 00:00:00 2001
From: Darren Salt <linux@youmustbejoking.demon.co.uk>
Date: Tue, 10 Feb 2009 17:17:50 +0000
Subject: Fix broken size checks in various input plugins (ref. CVE-2008-5239).

---
 src/input/input_dvb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/input/input_dvb.c')

diff --git a/src/input/input_dvb.c b/src/input/input_dvb.c
index 9c592a067..5060757e4 100644
--- a/src/input/input_dvb.c
+++ b/src/input/input_dvb.c
@@ -2602,7 +2602,9 @@ static buf_element_t *dvb_plugin_read_block (input_plugin_t *this_gen,
   buf_element_t        *buf = fifo->buffer_pool_alloc (fifo);
   int                   total_bytes;
 
-  if (todo < 0 || todo > buf->size) {
+  if (todo > buf->max_size)
+    todo = buf->max_size;
+  if (todo < 0) {
     buf->free_buffer (buf);
     return NULL;
   }
-- 
cgit v1.2.3