[dvblast-devel] Check input buffer size in en50221_SendMMIObject()

[Christophe Massiot]

dvblast | branch: master | Christophe Massiot <massiot at via.ecp.fr> | Sat Dec 24 18:01:51 2011 +0100| [10cfc926b2bbb0647562007d66692f8e9c770a3f] | committer: Christophe Massiot

Check input buffer size in en50221_SendMMIObject()

> http://git.videolan.org/gitweb.cgi/dvblast.git/?a=commit;h=10cfc926b2bbb0647562007d66692f8e9c770a3f
---

 en50221.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/en50221.c b/en50221.c
index 473a14b..8af0626 100644
--- a/en50221.c
+++ b/en50221.c
@@ -2396,6 +2396,12 @@ uint8_t en50221_SendMMIObject( uint8_t *p_buffer, ssize_t i_size )
     int i_session_id, i_slot;
     struct cmd_mmi_send *p_cmd = (struct cmd_mmi_send *)p_buffer;
 
+    if ( i_size < sizeof(struct cmd_mmi_send))
+    {
+        msg_Err( NULL, "command packet too short (%zd)\n", i_size );
+        return RET_HUH;
+    }
+
     if ( en50221_UnserializeMMIObject( &p_cmd->object, i_size -
                          ((void *)&p_cmd->object - (void *)p_cmd) ) == -1 )
          return RET_ERR;