[linux-dvb] dvb_demux.c

[Asier Aguirre]

Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line 
269 (see patch) is not granted to be a positive value, yielding in a 
kernel segfault in the memcopy of line 292, and then hanging the system.

Asier Aguirre
-------------------------------------------------------------------------------------------------------------------
Este correo electr�nico y, en su caso, cualquier fichero anexo al mismo, contiene 
informaci�n de car�cter confidencial exclusivamente dirigida a su destinatario o 
destinatarios. Queda prohibida su divulgaci�n, copia o distribuci�n a terceros sin la 
previa autorizaci�n escrita de Indra. En el caso de haber recibido este correo 
electr�nico por error, se ruega notificar inmediatamente esta circunstancia mediante 
reenv�o a la direcci�n electr�nica del remitente.
The information in this e-mail and in any attachments is confidential and solely for the attention and use of the named addressee(s). You are hereby notified that any dissemination, distribution or copy of this communication is prohibited without the prior written consent of Indra. If you have received this communication in error, please, notify the sender by reply e-mail
diff -ur linux-2.6.0-test9/drivers/media/dvb/dvb-core/dvb_demux.c 
linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c
--- linux-2.6.0-test9/drivers/media/dvb/dvb-core/dvb_demux.c    2003-10-31 
10:22:14.000000000 +0100
+++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c    2003-10-31 
10:33:00.000000000 +0100
@@ -266,7 +266,7 @@
                p += buf[p] + 1;                // skip rest of last section
                count = 188 - p;
 
-               while (count) {
+               while (count>0) {
 
                        sec->crc_val = ~0;