[linux-dvb] Re: Crashes in dvb_demux.c

[Emard <emard@softhome.net>]

On Sun, Feb 09, 2003 at 07:29:31PM +0100, Florian Schirmer wrote:
> Hi,
> 
> >			if ((count>2) && // enough data to determine sec
> length?
> >			    ((sec->seclen = section_length(buf+p)) <=
> count)) {
> >				if (sec->seclen>4096) 
> 
> >buf+p contains 188 bytes or less (188-p), assuming p is positive.
> >
> >sec->seclen can contain up to 4096 bytes.
> 
> We'll check at the beginning (see above) wether sec->seclen is smaller that
> the payload bytes of buf+p. Only if that is true this code path will be
> used. (Section is smaller than a TS packet). At least this part looks safe
> to me ;-)

What if sec->seclen is already negative (-1) ? It can be -1 < count and 
also -1 < 4096, but would lead to infinite memcopy

Emard


-- 
Info:
To unsubscribe send a mail to listar@linuxtv.org with "unsubscribe linux-dvb" as subject.