From: Mark Adams Date: Wed, 9 Nov 2005 05:35:50 +0000 (-0800) Subject: [PATCH] dvb: fix bug in demux that caused lost mpeg sections X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b3967d6c251d8482fe42a1aad3cc292ee04c0a6b;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git [PATCH] dvb: fix bug in demux that caused lost mpeg sections Fix a bug in the software demux which causes large MPEG sections to be lost when they follow very small sections. The problem happens when two sections begin in the same transport packet. The dvb_demux code resets its buffer only before the first of these sections. This means that when the second (or subsequent) section begins, there is up to 182 bytes of buffer space already used. If the following section is close to the maximum size, it currently won't fit in the (4096-byte) buffer and is thrown away. The fix is simply to enlarge the buffer by the size of one transport packet and correct one usage of the SECFEED_SIZE definition where what is really meant is the maximum size of a section. Signed-off-by: Mark Adams Signed-off-by: Michael Krufky Cc: Johannes Stezenbach Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/media/dvb/dvb-core/demux.h b/drivers/media/dvb/dvb-core/demux.h index 9719a3b30f78..7d7b0067f228 100644 --- a/drivers/media/dvb/dvb-core/demux.h +++ b/drivers/media/dvb/dvb-core/demux.h @@ -48,8 +48,11 @@ * DMX_MAX_SECFEED_SIZE: Maximum length (in bytes) of a private section feed filter. */ +#ifndef DMX_MAX_SECTION_SIZE +#define DMX_MAX_SECTION_SIZE 4096 +#endif #ifndef DMX_MAX_SECFEED_SIZE -#define DMX_MAX_SECFEED_SIZE 4096 +#define DMX_MAX_SECFEED_SIZE (DMX_MAX_SECTION_SIZE + 188) #endif diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index dc476dda2b71..b4c899b15959 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -246,7 +246,7 @@ static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed, for (n = 0; sec->secbufp + 2 < limit; n++) { seclen = section_length(sec->secbuf); - if (seclen <= 0 || seclen > DMX_MAX_SECFEED_SIZE + if (seclen <= 0 || seclen > DMX_MAX_SECTION_SIZE || seclen + sec->secbufp > limit) return 0; sec->seclen = seclen;