Ralph Metzler wrote:
> Asier Aguirre writes:
> > [1 <text/plain; us-ascii (7bit)>]
> > Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line
> > 269 (see patch) is not granted to be a positive value, yielding in a
> > kernel segfault in the memcopy of line 292, and then hanging the system.
> >
> [...]
> > +++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c
> 2003-10-31 10:33:00.000000000 +0100
> > @@ -266,7 +266,7 @@
> > p += buf[p] + 1; // skip rest of last section
> > count = 188 - p;
> >
> > - while (count) {
> > + while (count>0) {
> >
> > sec->crc_val = ~0;
> >
>
> True, this has to be "count>0" and it actually always used to be.
> Is this only wrong in the test9 kernel or also in other versions?
Funny, this happend in a "cleanup" in Nov. 2002.
Currected in dvb-kernel and DVB CVS now.
Thanks,
johannes
--
Info:
To unsubscribe send a mail to [EMAIL PROTECTED] with "unsubscribe linux-dvb" as
subject.
