[mythtv] [PATCH] Potential crash in hdtvrecorder

[Isaac Richards]

On Friday 14 November 2003 04:02 pm, Jason Hoos wrote:
> I took a look, and there still might be a case that could cause a potential
> problem.  The way I wrote the code, limiting sec_len to pkt_len won't
> prevent the code from trying to write past the end of the packet, because
> the code doesn't check pos against sec_len.
>
> I've attached a reworked patch that should take care of this.  If we pass
> in pkt_len to RewritePAT like you did, then the sec_len variable pretty
> much becomes useless, so I got rid of it.  I also added a bounds check on
> the new packet to make sure it'll fit in the space we have to work with; if
> it doesn't RewritePAT will return false, which will prevent the packet from
> being written out in ProcessData.
>
> I also added a check to RewritePMT to check sec_len against pkt_len.  That
> function may have more issues now if the PMT section spans more than one
> packet, since now it just won't write the PMT packet at all, but that's not
> much better or worse than what it would have done before.  (Before it would
> have tried to write the checksum to some part of the buffer that wasn't
> part of the packet, which means the resulting packet would have been
> corrupt anyways.)

I've applied this to CVS, thanks.

Isaac