Opened 12 years ago

Closed 11 years ago

#4840 closed defect (fixed)

title_devs has only 9 entries. It will be overrun if for loop goes to i=8

Reported by: Erik Hovland <erik@…> Owned by: Isaac Richards
Priority: minor Milestone: 0.22
Component: mythtv Version: 0.21-fixes
Severity: low Keywords:
Cc: Ticket locked: no

Description

In the function DVDReadBlocksPath a for loop goes through all 9 entries in the title_devs array. But it will index i+1, which will be 9 and out of range of the array if the for loop increments to i=8. Which it can do.

Attachments (1)

libs_libmythdvdnav_dvd_reader.c-prevent-overrun-of-title_devs.patch (957 bytes) - added by Erik Hovland <erik@…> 12 years ago.
breaks for loop if i=8 and we are about to index i+1

Download all attachments as: .zip

Change History (3)

Changed 12 years ago by Erik Hovland <erik@…>

breaks for loop if i=8 and we are about to index i+1

comment:1 Changed 12 years ago by Isaac Richards

Milestone: 0.210.22

comment:2 Changed 11 years ago by danielk

Resolution: fixed
Status: newclosed

(In [17545]) Fixes #4840. Prevent dvdnav from reading memory that does not belong to it.. There is a FIXME comment in the code, but until someone comes up with the proper fix we should at least not crash.

Note: See TracTickets for help on using tickets.