Bug#826072: alevt: Program table overflow

Frank Heckenbach f.heckenbach at fh-soft.de
Thu Jun 2 03:09:54 UTC 2016


Package: dvb-apps
Version: 1.1.1+rev1500-1+fh1
Severity: normal
File: /usr/bin/alevt
Tags: patch

progtbl has a size of 16 (actually, only 15 are used due to the
check "progcnt >= sizeof(progtbl)/sizeof(progtbl[0])"; maybe this
should be ">", unless the last entry is needed as a terminator).

Anyway, one channel I receive (DE-Nuremberg, DVB-T, 786000000 Hz,
Eurosport etc.) has a size of 17, so it's too small either way and
alevt aborts with the message given in the subject.

I don't know if there are official size limits, or whether there are
side-effects to my change, but for now, just increasing the size
seems to work for me.

The same code exists in the alevt package, may need to be patched
there, too.

--- util/alevt/vbi.c
+++ util/alevt/vbi.c
@@ -628,7 +628,7 @@
 		u_int8_t txttype;
 		u_int8_t txtmagazine;
 		u_int8_t txtpage;
-	} progtbl[16], *progp;
+	} progtbl[32], *progp;
 	u_int8_t tbl[4096];
 	u_int8_t * ppname, * psname, pncode, sncode, pnlen, snlen;
 	int r;



More information about the pkg-vdr-dvb-devel mailing list