Re: [PATCH] SEGV fixed in dvbpsi_decoder_psi_section_add
Jean-Paul Saman <[email protected]>
| Newsgroups | gmane.comp.video.videolan.libdvbpsi.devel |
|---|---|
| Message-ID | <CAK9US3CiRQAu_dPqh6tkgFM=NEhLUd8XKACU82aN97ia1jVOCQ@mail.gmail.com> |
Robert, On Mon, Sep 3, 2012 at 3:07 PM, Roberto Corno <[email protected]> wrote: > SEGV happens within dvbpsi_decoder_psi_section_add when p->i_number == > p_section->i_number and p_prev == NULL. > It's the first branch of the while(p) loop. > I got it with a heavily degraded transport stream, where a lot of CC error > occur. > I've added the check for p_prev==NULL > Patch attached. Your patch ignores the new section instead of replacing the section with the same number. The caller could therefor leak the section pointer. Please try this patch instead. Kind regards, Jean-Paul Saman _______________________________________________ libdvbpsi-devel mailing list [email protected] http://mailman.videolan.org/listinfo/libdvbpsi-devel
0001-src-dvbpsi.c-fix-segmentation-fault-in-dvbpsi_decode.patch
(application/octet-stream, 1.7 KB)
From 9ae00f930a6db41ba68d3c82dbe39b0b2f5831c3 Mon Sep 17 00:00:00 2001 From: Jean-Paul Saman <[email protected]> Date: Tue, 4 Sep 2012 13:29:02 +0200 Subject: [PATCH] src/dvbpsi.c: fix segmentation fault in dvbpsi_decoder_psi_section_add() When p->i_number == p_section->i_number AND p_prev == NULL, then the function will crash with a segmentation fault. In this case the first element in the linked list is going to be replaced. The pointer p_prev does not point to a valid sections, since p is the first element in the list. To solve this case it needs to be treated seperate. --- src/dvbpsi.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/src/dvbpsi.c b/src/dvbpsi.c index 5198a98..f4fd5d8 100644 --- a/src/dvbpsi.c +++ b/src/dvbpsi.c @@ -258,11 +258,22 @@ bool dvbpsi_decoder_psi_section_add(dvbpsi_decoder_t *p_decoder, dvbpsi_psi_sect if (p->i_number == p_section->i_number) { /* Replace */ - p_prev->p_next = p_section; - p_section->p_next = p->p_next; - p->p_next = NULL; - dvbpsi_DeletePSISections(p); - b_overwrite = true; + if (p_prev) + { + p_prev->p_next = p_section; + p_section->p_next = p->p_next; + p->p_next = NULL; + dvbpsi_DeletePSISections(p); + b_overwrite = true; + } + else + { + p_section->p_next = p->p_next; + p->p_next = NULL; + dvbpsi_DeletePSISections(p); + p = p_section; + b_overwrite = true; + } goto out; } else if (p->i_number > p_section->i_number) -- 1.7.11.4