[linux-dvb] AW: Re: Crashes in dvb_demux.c

[Florian Schirmer]

Hi,

>What if sec->seclen is already negative (-1) ? It can be -1 < count and 
>also -1 < 4096, but would lead to infinite memcopy

sec->seclen is set as "3+((buf[1]&0x0f)<<8)+buf[2]". This can not result in
a negative length.

Bye,
   Florian




-- 
Info:
To unsubscribe send a mail to [EMAIL PROTECTED] with "unsubscribe linux-dvb" as 
subject.