descriptors: be sure to not read past the buffer

The loop will read 2 bytes from ptr, to get descriptor type and
length. Be sure that those two bytes are available.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/lib/libdvbv5/descriptors.c b/lib/libdvbv5/descriptors.c
index 46c3be9..92ebc54 100644 (file)
--- a/lib/libdvbv5/descriptors.c
+++ b/lib/libdvbv5/descriptors.c
@@ -99,7 +99,8 @@ void dvb_parse_descriptors(struct dvb_v5_fe_parms *parms, const uint8_t *buf,
        const uint8_t *ptr = buf;
        struct dvb_desc *current = NULL;
        struct dvb_desc *last = NULL;
-       while (ptr < buf + section_length) {
+
+       while (ptr + 2 < buf + section_length) {
                unsigned desc_type = ptr[0];
                int desc_len  = ptr[1];
                size_t size;