[libdvbpsi-devel] dr_a1: check the descriptor length before allocating p_decoded

[Michael Krufky]

libdvbpsi | branch: master | Michael Krufky <mkrufky at linuxtv.org> | Sun May 19 15:56:09 2013 -0400| [c833e5a7842425e6341ae421ec7f044a583e00c4] | committer: Jean-Paul Saman

dr_a1: check the descriptor length before allocating p_decoded

Signed-off-by: Michael Krufky <mkrufky at linuxtv.org>

> http://git.videolan.org/gitweb.cgi/libdvbpsi.git/?a=commit;h=c833e5a7842425e6341ae421ec7f044a583e00c4
---

 src/descriptors/dr_a1.c |   11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/src/descriptors/dr_a1.c b/src/descriptors/dr_a1.c
index cbde4b1..b4242cc 100644
--- a/src/descriptors/dr_a1.c
+++ b/src/descriptors/dr_a1.c
@@ -59,6 +59,10 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr(
   if(p_descriptor->p_decoded)
     return p_descriptor->p_decoded;
 
+  /* Check length */
+  if((p_descriptor->i_length - 3) % 6)
+    return NULL;
+
   /* Allocate memory */
   p_decoded =
         (dvbpsi_service_location_dr_t*)malloc(sizeof(dvbpsi_service_location_dr_t));
@@ -66,13 +70,6 @@ dvbpsi_service_location_dr_t * dvbpsi_DecodeServiceLocationDr(
 
   memset(p_decoded, 0, sizeof(dvbpsi_service_location_dr_t));
 
-  /* Decode data and check the length */
-  if(p_descriptor->i_length < 3)
-  {
-    free(p_decoded);
-    return NULL;
-  }
-
   p_descriptor->p_decoded = (void*)p_decoded;
 
   p_decoded->i_pcr_pid = dvbpsi_get_bits(buf, 3, 13);