Hi,
> if ((count>2) && // enough data to determine sec
length?
> ((sec->seclen = section_length(buf+p)) <=
count)) {
> if (sec->seclen>4096)
>buf+p contains 188 bytes or less (188-p), assuming p is positive.
>
>sec->seclen can contain up to 4096 bytes.
We'll check at the beginning (see above) wether sec->seclen is smaller that
the payload bytes of buf+p. Only if that is true this code path will be
used. (Section is smaller than a TS packet). At least this part looks safe
to me ;-)
Bye,
Florian
--
Info:
To unsubscribe send a mail to [EMAIL PROTECTED] with "unsubscribe linux-dvb" as
subject.
