diff options
| -rw-r--r-- | drivers/media/dvb/dvb-core/demux.h | 5 | ||||
| -rw-r--r-- | drivers/media/dvb/dvb-core/dvb_demux.c | 2 |
2 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/dvb/dvb-core/demux.h b/drivers/media/dvb/dvb-core/demux.h index 9719a3b30f7..7d7b0067f22 100644 --- a/drivers/media/dvb/dvb-core/demux.h +++ b/drivers/media/dvb/dvb-core/demux.h @@ -48,8 +48,11 @@ * DMX_MAX_SECFEED_SIZE: Maximum length (in bytes) of a private section feed filter. */ +#ifndef DMX_MAX_SECTION_SIZE +#define DMX_MAX_SECTION_SIZE 4096 +#endif #ifndef DMX_MAX_SECFEED_SIZE -#define DMX_MAX_SECFEED_SIZE 4096 +#define DMX_MAX_SECFEED_SIZE (DMX_MAX_SECTION_SIZE + 188) #endif diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index dc476dda2b7..b4c899b1595 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -246,7 +246,7 @@ static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed, for (n = 0; sec->secbufp + 2 < limit; n++) { seclen = section_length(sec->secbuf); - if (seclen <= 0 || seclen > DMX_MAX_SECFEED_SIZE + if (seclen <= 0 || seclen > DMX_MAX_SECTION_SIZE || seclen + sec->secbufp > limit) return 0; sec->seclen = seclen; |