From 6ac30786ded731fab386b26c1355723649a16592 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Fri, 14 Feb 2014 13:22:25 +0900 Subject: [PATCH] descriptors: be sure to not read past the buffer The loop will read 2 bytes from ptr, to get descriptor type and length. Be sure that those two bytes are available. Signed-off-by: Mauro Carvalho Chehab --- lib/libdvbv5/descriptors.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/libdvbv5/descriptors.c b/lib/libdvbv5/descriptors.c index 46c3be9..92ebc54 100644 --- a/lib/libdvbv5/descriptors.c +++ b/lib/libdvbv5/descriptors.c @@ -99,7 +99,8 @@ void dvb_parse_descriptors(struct dvb_v5_fe_parms *parms, const uint8_t *buf, const uint8_t *ptr = buf; struct dvb_desc *current = NULL; struct dvb_desc *last = NULL; - while (ptr < buf + section_length) { + + while (ptr + 2 < buf + section_length) { unsigned desc_type = ptr[0]; int desc_len = ptr[1]; size_t size; -- 2.7.4