Hi,

I have found a bug in the software demultiplexer of the DVB driver.
The input buffer is passed by reference to the dvb_dmx_swfilter_section_feed function.
This function clears a part of the buffer, with the statement :
memset(buf, 0, DVB_DEMUX_MASK_MAX);
regardless of the size of the section.


As a result, when a section is shorter than DVB_DEMUX_MASK_MAX, the data of the next section are cleared.
This is an example :


before dvb_dmx_swfilter_section_feed:
70 70 05 CF 49 16 22 18 73 70 1A CF 49 16 22 18 F0 0F 58 0D 49 54 41 02 01 00 CE CA 01 00 00 01 00 9D 11 03 33 FF FF FF FF FF FF FF FF FF FF FF


after dvb_dmx_swfilter_section_feed:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 0D 49 54 41 02 01 00 CE CA 01 00 00 01 00 9D 11 03 33 FF FF FF FF FF FF FF FF FF FF FF



I don't know exactly why it is necessary to clear the buffer, but if it is, I suggest the following patch :



--- dvb_demux.c.orig 2004-03-01 17:42:28.000000000 +0100 +++ dvb_demux.c 2004-03-01 17:43:42.000000000 +0100 @@ -213,10 +213,13 @@ return -1; } while ((f = f->next) && sec->is_filtering);

+       if (sec->seclen < DVB_DEMUX_MASK_MAX)
+               memset(buf, 0, sec->seclen);
+       else
+               memset(buf, 0, DVB_DEMUX_MASK_MAX);
+
        sec->seclen = 0;

-       memset(buf, 0, DVB_DEMUX_MASK_MAX);
-
        return 0;
 }



With this patch applied, the next section is no longer overwritten :

before dvb_dmx_swfilter_section_feed:
70 70 05 CF 49 16 32 23 73 70 1A CF 49 16 32 23 F0 0F 58 0D 49 54 41 02 01 00 CE CA 01 00 00 01 00 F3 64 BB C7 FF FF FF FF FF FF FF FF FF FF FF


after dvb_dmx_swfilter_section_feed:
00 00 00 00 00 00 00 00 73 70 1A CF 49 16 32 23 F0 0F 58 0D 49 54 41 02 01 00 CE CA 01 00 00 01 00 F3 64 BB C7 FF FF FF FF FF FF FF FF FF FF FF



That patch solves the problem found by Uberto Barbini last week.



Jean-Claude




--
Info:
To unsubscribe send a mail to [EMAIL PROTECTED] with "unsubscribe linux-dvb" as 
subject.



Reply via email to