aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab+huawei@kernel.org>2021-02-23 13:37:08 +0100
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>2021-02-23 13:38:40 +0100
commitb5483d01da02257375e39a268cbc02d449bbcfde (patch)
tree5cabc1b19891084886cf396dd5540e5ec58faa3d
parentd83e06e3ad829bd43829f71fad316d2ca9d37e8d (diff)
libdvbv5: validate cable descriptor's size
Check if the size has the expected value. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-rw-r--r--lib/libdvbv5/descriptors/desc_cable_delivery.c16
1 files changed, 13 insertions, 3 deletions
diff --git a/lib/libdvbv5/descriptors/desc_cable_delivery.c b/lib/libdvbv5/descriptors/desc_cable_delivery.c
index 3c969d90..1625792c 100644
--- a/lib/libdvbv5/descriptors/desc_cable_delivery.c
+++ b/lib/libdvbv5/descriptors/desc_cable_delivery.c
@@ -29,10 +29,20 @@
int dvb_desc_cable_delivery_init(struct dvb_v5_fe_parms *parms, const uint8_t *buf, struct dvb_desc *desc)
{
struct dvb_desc_cable_delivery *cable = (struct dvb_desc_cable_delivery *) desc;
+ size_t len, dlen = desc->length;
+ size_t start;
+
+ start = offsetof(struct dvb_desc_cable_delivery, frequency);
+ len = sizeof(*cable) - start;
+
+ if (len != dlen) {
+ dvb_logwarn("cable delivery descriptor size is wrong: expected %zu, received %zu",
+ len, dlen);
+ return -1;
+ }
+
/* copy only the data - length already initialize */
- memcpy(((uint8_t *) cable ) + sizeof(cable->type) + sizeof(cable->next) + sizeof(cable->length),
- buf,
- cable->length);
+ memcpy(((uint8_t *) cable) + start, buf, dlen);
bswap32(cable->frequency);
bswap16(cable->bitfield1);
bswap32(cable->bitfield2);

Privacy Policy