Opened 18 years ago

Closed 17 years ago

#4840 closed defect (fixed)

title_devs has only 9 entries. It will be overrun if for loop goes to i=8

Reported by: Erik Hovland <erik@…> Owned by: Isaac Richards
Priority: minor Milestone: 0.22
Component: mythtv Version: 0.21-fixes
Severity: low Keywords:
Cc: Ticket locked: no

Description

In the function DVDReadBlocksPath a for loop goes through all 9 entries in the title_devs array. But it will index i+1, which will be 9 and out of range of the array if the for loop increments to i=8. Which it can do.

Attachments (1)

libs_libmythdvdnav_dvd_reader.c-prevent-overrun-of-title_devs.patch​ (957 bytes ) - added by Erik Hovland <erik@…> 18 years ago.
breaks for loop if i=8 and we are about to index i+1

Download all attachments as: .zip

Change History (3)

by Erik Hovland <erik@…>, 18 years ago

Attachment: libs_libmythdvdnav_dvd_reader.c-prevent-overrun-of-title_devs.patch​ added

breaks for loop if i=8 and we are about to index i+1

comment:1 by Isaac Richards, 18 years ago

Milestone: 0.21 → 0.22

comment:2 by danielk, 17 years ago

Resolution: → fixed
Status: new → closed

(In [17545]) Fixes #4840. Prevent dvdnav from reading memory that does not belong to it.. There is a FIXME comment in the code, but until someone comes up with the proper fix we should at least not crash.

Note: See TracTickets for help on using tickets.