Asier Aguirre writes:
> [1 <text/plain; us-ascii (7bit)>]
> Hi there, I've found a flaw in dvb_demux.c. The value of 'count' in line
> 269 (see patch) is not granted to be a positive value, yielding in a
> kernel segfault in the memcopy of line 292, and then hanging the system.
>
[...]
> +++ linux-2.6.0-test9_develop/drivers/media/dvb/dvb-core/dvb_demux.c 2003-10-31
> 10:33:00.000000000 +0100
> @@ -266,7 +266,7 @@
> p += buf[p] + 1; // skip rest of last section
> count = 188 - p;
>
> - while (count) {
> + while (count>0) {
>
> sec->crc_val = ~0;
>
True, this has to be "count>0" and it actually always used to be.
Is this only wrong in the test9 kernel or also in other versions?
Ralph
--
Info:
To unsubscribe send a mail to [EMAIL PROTECTED] with "unsubscribe linux-dvb" as
subject.
