[mythtv] [PATCH] Potential crash in hdtvrecorder

[Jason Hoos]

I took a look, and there still might be a case that could cause a potential
problem.  The way I wrote the code, limiting sec_len to pkt_len won't
prevent the code from trying to write past the end of the packet, because
the code doesn't check pos against sec_len.

I've attached a reworked patch that should take care of this.  If we pass in
pkt_len to RewritePAT like you did, then the sec_len variable pretty much
becomes useless, so I got rid of it.  I also added a bounds check on the new
packet to make sure it'll fit in the space we have to work with; if it
doesn't RewritePAT will return false, which will prevent the packet from
being written out in ProcessData.

I also added a check to RewritePMT to check sec_len against pkt_len.  That
function may have more issues now if the PMT section spans more than one
packet, since now it just won't write the PMT packet at all, but that's not
much better or worse than what it would have done before.  (Before it would
have tried to write the checksum to some part of the buffer that wasn't part
of the packet, which means the resulting packet would have been corrupt
anyways.)

- Jason


> -----Original Message-----
> [mailto:mythtv-dev-bounces at mythtv.org] On Behalf Of Doug Larrick
> Sent: Friday, November 14, 2003 7:18 AM
> 
> 
> The attached patch solves a potential crash in hdtvrecorder, 
> one that  
> will only occur with a corrupt data stream (i.e. weak reception).
> 
> -Doug
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hd-crash2.diff
Type: application/octet-stream
Size: 4504 bytes
Desc: not available
Url : http://mythtv.org/pipermail/mythtv-dev/attachments/20031114/03c750b7/hd-crash2.obj