Hello,
I recently got segmentation faults when using dvbv5-scan (dvbv5-scan
-l UNIVERSAL -S1 /usr/share/dvbv5/dvb-s/Astra-19.2E).
I found out that this happened due to (d->length < len) in int isdbt_desc_delivery_init for some transponder, which results in irrealistic d->num_freqs. I did not trace back why this happens, but suggest the patch below to get at least rid of the segfault.
Additionally I found a memory leak:
1. dvb-dev.c, dvb_dev_alloc: dvb is alloc'd, dvb->d is returned, the rest is never freed.
Regards
Georg
---------------- lib/libdvbv5/descriptors/desc_isdbt_delivery.c ----------------
index 4a0f294..6623ca4 100644
@@ -36,7 +36,12 @@ int isdbt_desc_delivery_init(struct dvb_v5_fe_parms *parms,
bswap16(d->bitfield);
- d->num_freqs = (d->length - len)/ sizeof(uint16_t);
+ if (d->length < len) {
+ dvb_perror("d->length>len!!");
+ d->num_freqs=0;
+ }
+ else
+ d->num_freqs = (d->length - len)/ sizeof(uint16_t);
if (!d->num_freqs)
return 0;
d->frequency = malloc(d->num_freqs * sizeof(*d->frequency));
--------------------------- lib/libdvbv5/dvb-file.c ---------------------------
index 33481e5..169c0b5 100644
@@ -1274,6 +1274,7 @@ int dvb_store_channel(struct dvb_file **dvb_file,
return 0;
}
+ if (dvb_scan_handler->sdt->service)
dvb_sdt_service_foreach(service, dvb_scan_handler->sdt) {
char *channel = NULL;
char *vchannel = NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
