[libdvbpsi-devel] [PATCH] Fix improper local variable access in dr_7c

[Jean-Paul Saman]

Patch applied, thanks for contributing.


Kind regards

Jean-Paul Saman

On Wed, Mar 4, 2015 at 11:18 PM, Daniel Kamil Kozar <dkk089 at gmail.com>
wrote:

> The address of a local variable instead of its actual value was passed
> to memcpy. As a result, the actual memory referenced by the
> p_additional_info pointer was never written to when decoding the
> descriptor. Analogous issue occurred when generating.
> ---
>  src/descriptors/dr_7c.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/src/descriptors/dr_7c.c b/src/descriptors/dr_7c.c
> index f51acb4..41d1d8a 100644
> --- a/src/descriptors/dr_7c.c
> +++ b/src/descriptors/dr_7c.c
> @@ -257,7 +257,7 @@ dvbpsi_aac_dr_t
> *dvbpsi_DecodeAACDr(dvbpsi_descriptor_t *p_descriptor)
>
>          uint8_t i_data = p_decoded->b_type ? 3 : 2;
>          uint8_t *p = &p_descriptor->p_data[i_data];
> -        memcpy(&p_decoded->p_additional_info, p, i_info_length);
> +        memcpy(p_decoded->p_additional_info, p, i_info_length);
>      }
>
>      p_descriptor->p_decoded = (void*)p_decoded;
> @@ -292,7 +292,7 @@ dvbpsi_descriptor_t *dvbpsi_GenAACDr(dvbpsi_aac_dr_t
> *p_decoded, bool b_duplicat
>      if (p_descriptor->i_length > 1)
>      {
>          uint8_t *p = &p_descriptor->p_data[p_decoded->b_type ? 3 : 2];
> -        memcpy(&p, p_decoded->p_additional_info,
> p_decoded->i_additional_info_length);
> +        memcpy(p, p_decoded->p_additional_info,
> p_decoded->i_additional_info_length);
>      }
>
>      if (b_duplicate)
> --
> 2.3.1
>
> _______________________________________________
> libdvbpsi-devel mailing list
> libdvbpsi-devel at videolan.org
> https://mailman.videolan.org/listinfo/libdvbpsi-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.videolan.org/pipermail/libdvbpsi-devel/attachments/20150305/0edd0a88/attachment.html>