[libdvbpsi-devel] [PATCH] atsc_ett: fix bug: nobody allocated p_etm_data!!

[Jean-Paul Saman]

Mike,


On Wed, Dec 25, 2013 at 5:20 AM, Michael Krufky <mkrufky at linuxtv.org> wrote:

> Jean-Paul,
>
> After updating my code to use the latest libdvbpsi, I found a nasty
> crash when processing ETT tables... Turns out that libdvbpsi is
> memcpy'ing the etm data to a pointer that hasn't been allocated!
>
> Please either apply the included patch or merge it via the pull request
> below.
>
> Happy Holidays & Best regards,
>
> Michael Krufky
>

I already had a fix for this in my test tree and did not merge this one.

If you feel my solutions is wrong, then do not hesitate to correct it.

Kind regards,

Jean-Paul Saman



> The following changes since commit
> 4037adea3581059ec7e4253747192868198b6e6b:
>
>   Merge branch 'branch/1.1.0-bugfix' of git.m2x.eu:libdvbpsi
>   (2013-11-05 09:24:30 +0100)
>
> are available in the git repository at:
>
>
>   https://github.com/mkrufky/libdvbpsi.git atsc-ett-bugfix
>
> for you to fetch changes up to 1c5dc1d40f692aaf6a6f4687bdeeef22848cbc9c:
>
>   atsc_ett: fix bug: nobody allocated p_etm_data (2013-12-24 23:11:23
>   -0500)
>
> ----------------------------------------------------------------
> Michael Krufky (1):
>       atsc_ett: fix bug: nobody allocated p_etm_data
>
>  src/tables/atsc_ett.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> ---
>
> From 1c5dc1d40f692aaf6a6f4687bdeeef22848cbc9c Mon Sep 17 00:00:00 2001
> From: Michael Krufky <mkrufky at linuxtv.org>
> Date: Tue, 24 Dec 2013 23:11:23 -0500
> Subject: [PATCH] atsc_ett: fix bug: nobody allocated p_etm_data
>
> Signed-off-by: Michael Krufky <mkrufky at linuxtv.org>
> ---
>  src/tables/atsc_ett.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/tables/atsc_ett.c b/src/tables/atsc_ett.c
> index 2caa446..752637c 100644
> --- a/src/tables/atsc_ett.c
> +++ b/src/tables/atsc_ett.c
> @@ -416,6 +416,11 @@ static void
> dvbpsi_atsc_DecodeETTSections(dvbpsi_atsc_ett_t* p_ett,
>           * decoded table struct. */
>          if (p_ett->p_etm_data)
>              abort();
> +
> +        p_ett->p_etm_data = malloc(i_etm_length);
> +        if (!p_ett->p_etm_data)
> +            abort();
> +
>          memcpy(p_ett->p_etm_data, p_section->p_payload_start + 5,
> i_etm_length); p_ett->i_etm_length = i_etm_length;
>
> --
> 1.8.1.2
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.videolan.org/pipermail/libdvbpsi-devel/attachments/20140204/a138bbfc/attachment-0001.html>