From: Mauro Carvalho Chehab <m.chehab@samsung.com>
Date: Fri, 14 Feb 2014 04:22:25 +0000 (+0900)
Subject: descriptors: be sure to not read past the buffer
X-Git-Tag: v4l-utils-1.2.0~215
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6ac30786ded731fab386b26c1355723649a16592;p=platform%2Fupstream%2Fv4l-utils.git

descriptors: be sure to not read past the buffer

The loop will read 2 bytes from ptr, to get descriptor type and
length. Be sure that those two bytes are available.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
---

diff --git a/lib/libdvbv5/descriptors.c b/lib/libdvbv5/descriptors.c
index 46c3be9..92ebc54 100644
--- a/lib/libdvbv5/descriptors.c
+++ b/lib/libdvbv5/descriptors.c
@@ -99,7 +99,8 @@ void dvb_parse_descriptors(struct dvb_v5_fe_parms *parms, const uint8_t *buf,
 	const uint8_t *ptr = buf;
 	struct dvb_desc *current = NULL;
 	struct dvb_desc *last = NULL;
-	while (ptr < buf + section_length) {
+
+	while (ptr + 2 < buf + section_length) {
 		unsigned desc_type = ptr[0];
 		int desc_len  = ptr[1];
 		size_t size;