Commit b3967d6c authored by Mark Adams's avatar Mark Adams Committed by Linus Torvalds

[PATCH] dvb: fix bug in demux that caused lost mpeg sections

Fix a bug in the software demux which causes large MPEG sections to be lost
when they follow very small sections.

The problem happens when two sections begin in the same transport packet.  The
dvb_demux code resets its buffer only before the first of these sections.
This means that when the second (or subsequent) section begins, there is up to
182 bytes of buffer space already used.  If the following section is close to
the maximum size, it currently won't fit in the (4096-byte) buffer and is
thrown away.

The fix is simply to enlarge the buffer by the size of one transport packet
and correct one usage of the SECFEED_SIZE definition where what is really
meant is the maximum size of a section.
Signed-off-by: default avatarMark Adams <mark147m@gmail.com>
Signed-off-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
Cc: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent f0fa86a5
......@@ -48,8 +48,11 @@
* DMX_MAX_SECFEED_SIZE: Maximum length (in bytes) of a private section feed filter.
*/
#ifndef DMX_MAX_SECTION_SIZE
#define DMX_MAX_SECTION_SIZE 4096
#endif
#ifndef DMX_MAX_SECFEED_SIZE
#define DMX_MAX_SECFEED_SIZE 4096
#define DMX_MAX_SECFEED_SIZE (DMX_MAX_SECTION_SIZE + 188)
#endif
......
......@@ -246,7 +246,7 @@ static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed,
for (n = 0; sec->secbufp + 2 < limit; n++) {
seclen = section_length(sec->secbuf);
if (seclen <= 0 || seclen > DMX_MAX_SECFEED_SIZE
if (seclen <= 0 || seclen > DMX_MAX_SECTION_SIZE
|| seclen + sec->secbufp > limit)
return 0;
sec->seclen = seclen;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment