Fix buffer overflow (CID 188)

[vlc] / modules / access / dvb / en50221.c

diff --git a/modules/access/dvb/en50221.c b/modules/access/dvb/en50221.c
index 3b18c8581f0565b171b312daa56478cb7629aa98..9b7f98acfca21b89c649b696bece09d2a32d2552 100644 (file)
--- a/modules/access/dvb/en50221.c
+++ b/modules/access/dvb/en50221.c
@@ -26,7 +26,7 @@
 # include "config.h"
 #endif
 
-#include <vlc/vlc.h>
+#include <vlc_common.h>
 #include <vlc_access.h>
 
 #include <sys/ioctl.h>
@@ -39,6 +39,7 @@
 #include <unistd.h>
 #include <sys/stat.h>
 #include <sys/poll.h>
+#include <netinet/in.h>
 
 /* DVB Card Drivers */
 #include <linux/dvb/version.h>
@@ -54,6 +55,8 @@
 #   include <dvbpsi/pmt.h>
 #   include <dvbpsi/dr.h>
 #   include <dvbpsi/psi.h>
+#   include <dvbpsi/demux.h>
+#   include <dvbpsi/sdt.h>
 #else
 #   include "dvbpsi.h"
 #   include "descriptor.h"
@@ -61,6 +64,8 @@
 #   include "tables/pmt.h"
 #   include "descriptors/dr.h"
 #   include "psi.h"
+#   include "demux.h"
+#   include "sdt.h"
 #endif
 
 #ifdef ENABLE_HTTPD
@@ -80,7 +85,6 @@ static void ApplicationInformationOpen( access_t * p_access, int i_session_id );
 static void ConditionalAccessOpen( access_t * p_access, int i_session_id );
 static void DateTimeOpen( access_t * p_access, int i_session_id );
 static void MMIOpen( access_t * p_access, int i_session_id );
-static char *dvbsi_to_utf8( char *psz_instring, size_t i_length );
 
 /*****************************************************************************
  * Utility functions
@@ -173,6 +177,8 @@ static void Dump( bool b_outgoing, uint8_t *p_data, int i_size )
     for ( i = 0; i < i_size && i < MAX_DUMP; i++)
         fprintf(stderr, "%02X ", p_data[i]);
     fprintf(stderr, "%s\n", i_size >= MAX_DUMP ? "..." : "");
+#else
+    VLC_UNUSED(b_outgoing); VLC_UNUSED(p_data); VLC_UNUSED(i_size);
 #endif
 }
 
@@ -279,6 +285,8 @@ static int TPDURecv( access_t * p_access, uint8_t i_slot, uint8_t *pi_tag,
     if ( i_size < 5 )
     {
         msg_Err( p_access, "cannot read from CAM device (%d:%m)", i_size );
+        if( pi_size == NULL )
+            free( p_data );
         return VLC_EGENERIC;
     }
 
@@ -286,6 +294,8 @@ static int TPDURecv( access_t * p_access, uint8_t i_slot, uint8_t *pi_tag,
     {
         msg_Err( p_access, "invalid read from CAM device (%d instead of %d)",
                  p_data[1], i_tcid );
+        if( pi_size == NULL )
+            free( p_data );
         return VLC_EGENERIC;
     }
 
@@ -417,7 +427,7 @@ static void SessionOpen( access_t * p_access, uint8_t i_slot,
         if ( !p_sys->p_sessions[i_session_id - 1].i_resource_id )
             break;
     }
-    if ( i_session_id == MAX_SESSIONS )
+    if ( i_session_id > MAX_SESSIONS )
     {
         msg_Err( p_access, "too many sessions !" );
         return;
@@ -809,10 +819,8 @@ static int APDUSend( access_t * p_access, int i_session_id, int i_tag,
         }
         else
         {
-            char *psz_hex;
             ca_msg.length = i_size + p - p_apdu;
             if ( i_size == 0 ) ca_msg.length=3;
-            psz_hex = (char*)malloc( ca_msg.length*3 + 1);
             memcpy( ca_msg.msg, p_apdu, i_size + p - p_apdu );
             i_ret = ioctl(p_sys->i_ca_handle, CA_SEND_MSG, &ca_msg );
             if ( i_ret < 0 )
@@ -1200,8 +1208,11 @@ static void CAPMTFirst( access_t * p_access, int i_session_id,
                           0x3 /* only */, 0x1 /* ok_descrambling */,
                           &i_capmt_size );
 
-    if ( i_capmt_size )
+    if( i_capmt_size )
+    {
         APDUSend( p_access, i_session_id, AOT_CA_PMT, p_capmt, i_capmt_size );
+        free( p_capmt );
+    }
 }
 
 /*****************************************************************************
@@ -1234,8 +1245,11 @@ static void CAPMTAdd( access_t * p_access, int i_session_id,
                           0x4 /* add */, 0x1 /* ok_descrambling */,
                           &i_capmt_size );
 
-    if ( i_capmt_size )
+    if( i_capmt_size )
+    {
         APDUSend( p_access, i_session_id, AOT_CA_PMT, p_capmt, i_capmt_size );
+        free( p_capmt );
+    }
 }
 
 /*****************************************************************************
@@ -1254,8 +1268,11 @@ static void CAPMTUpdate( access_t * p_access, int i_session_id,
                           0x5 /* update */, 0x1 /* ok_descrambling */,
                           &i_capmt_size );
 
-    if ( i_capmt_size )
+    if( i_capmt_size )
+    {
         APDUSend( p_access, i_session_id, AOT_CA_PMT, p_capmt, i_capmt_size );
+        free( p_capmt );
+    }
 }
 
 /*****************************************************************************
@@ -1275,8 +1292,11 @@ static void CAPMTDelete( access_t * p_access, int i_session_id,
                           0x5 /* update */, 0x4 /* not selected */,
                           &i_capmt_size );
 
-    if ( i_capmt_size )
+    if( i_capmt_size )
+    {
         APDUSend( p_access, i_session_id, AOT_CA_PMT, p_capmt, i_capmt_size );
+        free( p_capmt );
+    }
 }
 
 /*****************************************************************************
@@ -1817,7 +1837,7 @@ static int InitSlot( access_t * p_access, int i_slot )
             break;
         }
 
-        if ( TPDUSend( p_access, i_slot, T_CREATE_TC, NULL, 0 )
+        if ( TPDUSend( p_access, i_slot, T_CREATE_TC, NULL, NULL )
                 != VLC_SUCCESS )
         {
             msg_Err( p_access,
@@ -1909,7 +1929,7 @@ int en50221_Init( access_t * p_access )
 #if HLCI_WAIT_CAM_READY
         while( ca_msg.msg[8] == 0xff && ca_msg.msg[9] == 0xff )
         {
-            if( p_access->b_die ) return VLC_EGENERIC;
+            if( !vlc_object_alive (p_access) ) return VLC_EGENERIC;
             msleep(1);
             msg_Dbg( p_access, "CAM: please wait" );
             APDUSend( p_access, 1, AOT_APPLICATION_INFO_ENQ, NULL, 0 );
@@ -2013,7 +2033,7 @@ int en50221_Poll( access_t * p_access )
 
         if ( !p_sys->pb_tc_has_data[i_slot] )
         {
-            if ( TPDUSend( p_access, i_slot, T_DATA_LAST, NULL, 0 ) !=
+            if ( TPDUSend( p_access, i_slot, T_DATA_LAST, NULL, NULL ) !=
                     VLC_SUCCESS )
             {
                 msg_Err( p_access,
@@ -2317,10 +2337,10 @@ static inline void *FixUTF8( char *p )
     return p;
 }
 
-static char *dvbsi_to_utf8( char *psz_instring, size_t i_length )
+char *dvbsi_to_utf8( char *psz_instring, size_t i_length )
 {
-    const char *psz_encoding;
-    char *psz_stringstart, *psz_outstring, *psz_tmp;
+    const char *psz_encoding, *psz_stringstart;
+    char *psz_outstring, *psz_tmp;
     char psz_encbuf[12];
     size_t i_in, i_out;
     vlc_iconv_t iconv_handle;