From 5976dd2cfcc1d542075252aa5d8d217b7c87631a Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 27 Nov 2013 19:13:14 -0200 Subject: [PATCH] libdvbv5: fix T2 delivery descriptor handler The data struct were not properly filled. Fix it. Signed-off-by: Mauro Carvalho Chehab --- lib/include/descriptors/desc_t2_delivery.h | 11 ++++---- lib/libdvbv5/descriptors/desc_t2_delivery.c | 42 ++++++++++++++++++++--------- 2 files changed, 34 insertions(+), 19 deletions(-) diff --git a/lib/include/descriptors/desc_t2_delivery.h b/lib/include/descriptors/desc_t2_delivery.h index aabc590..a36f6c1 100644 --- a/lib/include/descriptors/desc_t2_delivery.h +++ b/lib/include/descriptors/desc_t2_delivery.h @@ -31,12 +31,6 @@ struct dvb_desc_t2_delivery_subcell { } __attribute__((packed)); struct dvb_desc_t2_delivery { - uint32_t *centre_frequency; - uint8_t frequency_loop_length; - uint8_t subcel_info_loop_length; - struct dvb_desc_t2_delivery_subcell *subcell; - - uint8_t descriptor_tag_extension; uint8_t plp_id; uint16_t system_id; union { @@ -51,6 +45,11 @@ struct dvb_desc_t2_delivery { uint16_t SISO_MISO:2; }; }; + + uint32_t *centre_frequency; + uint8_t frequency_loop_length; + uint8_t subcel_info_loop_length; + struct dvb_desc_t2_delivery_subcell *subcell; } __attribute__((packed)); struct dvb_v5_fe_parms; diff --git a/lib/libdvbv5/descriptors/desc_t2_delivery.c b/lib/libdvbv5/descriptors/desc_t2_delivery.c index f6e285b..ab4361d 100644 --- a/lib/libdvbv5/descriptors/desc_t2_delivery.c +++ b/lib/libdvbv5/descriptors/desc_t2_delivery.c @@ -31,19 +31,31 @@ void dvb_desc_t2_delivery_init(struct dvb_v5_fe_parms *parms, { struct dvb_desc_t2_delivery *d = desc; unsigned char *p = (unsigned char *) buf; - size_t len; + size_t desc_len = ext->length - 1, len, len2; int i; - len = sizeof(*d); - memcpy(&d->centre_frequency, p, len); - p += len; + len = offsetof(struct dvb_desc_t2_delivery, bitfield); + len2 = offsetof(struct dvb_desc_t2_delivery, centre_frequency); - bswap16(d->system_id); + if (desc_len < len) { + dvb_logwarn("T2 delivery descriptor is too small"); + return; + } + if (desc_len < len2) { + memcpy(p, buf, len); + bswap16(d->system_id); + + if (desc_len != len) + dvb_logwarn("T2 delivery descriptor is truncated"); - if (ext->length - 1 <= 4) return; + } + memcpy(p, buf, len2); + p += len2; - bswap16(d->bitfield); + len = desc_len - (p - buf); + memcpy(&d->centre_frequency, p, len); + p += len; if (d->tfs_flag) d->frequency_loop_length = 1; @@ -52,9 +64,12 @@ void dvb_desc_t2_delivery_init(struct dvb_v5_fe_parms *parms, p++; } - d->centre_frequency = malloc(sizeof(*d->centre_frequency) * d->frequency_loop_length); - if (!d->centre_frequency) + d->centre_frequency = calloc(d->frequency_loop_length, + sizeof(*d->centre_frequency)); + if (!d->centre_frequency) { dvb_perror("Out of memory"); + return; + } memcpy(d->centre_frequency, p, sizeof(*d->centre_frequency) * d->frequency_loop_length); p += sizeof(*d->centre_frequency) * d->frequency_loop_length; @@ -65,9 +80,11 @@ void dvb_desc_t2_delivery_init(struct dvb_v5_fe_parms *parms, d->subcel_info_loop_length = *p; p++; - d->subcell = malloc(sizeof(*d->subcell) * d->subcel_info_loop_length); - if (!d->subcell) + d->subcell = calloc(d->subcel_info_loop_length, sizeof(*d->subcell)); + if (!d->subcell) { dvb_perror("Out of memory"); + return; + } memcpy(d->subcell, p, sizeof(*d->subcell) * d->subcel_info_loop_length); for (i = 0; i < d->subcel_info_loop_length; i++) @@ -81,8 +98,7 @@ void dvb_desc_t2_delivery_print(struct dvb_v5_fe_parms *parms, const struct dvb_desc_t2_delivery *d = desc; int i; - dvb_log("| t2 delivery"); - dvb_log("| descriptor_tag_extension %d", d->descriptor_tag_extension); + dvb_log("| DVB-T2 delivery"); dvb_log("| plp_id %d", d->plp_id); dvb_log("| system_id %d", d->system_id); -- 2.7.4