From patchwork Fri Oct 2 05:06:18 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Henrik Kurelid X-Patchwork-Id: 51290 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n9256un2022154 for ; Fri, 2 Oct 2009 05:06:56 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755318AbZJBFGv (ORCPT ); Fri, 2 Oct 2009 01:06:51 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754375AbZJBFGu (ORCPT ); Fri, 2 Oct 2009 01:06:50 -0400 Received: from proxy3.bredband.net ([195.54.101.73]:41337 "EHLO proxy3.bredband.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754218AbZJBFGu (ORCPT ); Fri, 2 Oct 2009 01:06:50 -0400 Received: from iph2.telenor.se (195.54.127.133) by proxy3.bredband.net (7.3.140.3) id 49F597CD03ED7655 for linux-media@vger.kernel.org; Fri, 2 Oct 2009 07:06:52 +0200 X-SMTPAUTH-B2: X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AuhHAI8nxUpT4++ePGdsb2JhbACBUYkLkAsBAQEBN7wGhCkE X-IronPort-AV: E=Sophos;i="4.44,491,1249250400"; d="scan'208";a="49790842" Received: from ua-83-227-239-158.cust.bredbandsbolaget.se (HELO evermeet.kurelid.se) ([83.227.239.158]) by iph2.telenor.se with ESMTP; 02 Oct 2009 07:06:52 +0200 Received: from CTPW4601 ([192.168.1.99]) by evermeet.kurelid.se (8.14.3/8.13.8) with ESMTP id n9255svW011919; Fri, 2 Oct 2009 07:06:51 +0200 From: "Henrik Kurelid" To: Cc: , Subject: [PATCH] firedtv: length field corrupt in ca2host if length>127 Date: Fri, 2 Oct 2009 07:06:18 +0200 Message-ID: <000a01ca431e$14250210$6301a8c0@ds.mot.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: AcpDHchVQTpPIXqYSsyDEg9/sAZTHA== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c index d056a40..143a322 100644 --- a/drivers/media/dvb/firewire/firedtv-avc.c +++ b/drivers/media/dvb/firewire/firedtv-avc.c @@ -1051,28 +1051,28 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length) c->operand[4] = 0; /* slot */ c->operand[5] = SFE_VENDOR_TAG_CA_PMT; /* ca tag */ c->operand[6] = 0; /* more/last */ - /* c->operand[7] = XXXprogram_info_length + 17; */ /* length */ - c->operand[8] = list_management; - c->operand[9] = 0x01; /* pmt_cmd=OK_descramble */ + /* Use three bytes for length field in case length > 127 */ + c->operand[10] = list_management; + c->operand[11] = 0x01; /* pmt_cmd=OK_descramble */ /* TS program map table */ - c->operand[10] = 0x02; /* Table id=2 */ - c->operand[11] = 0x80; /* Section syntax + length */ - /* c->operand[12] = XXXprogram_info_length + 12; */ - c->operand[13] = msg[1]; /* Program number */ - c->operand[14] = msg[2]; - c->operand[15] = 0x01; /* Version number=0 + current/next=1 */ - c->operand[16] = 0x00; /* Section number=0 */ - c->operand[17] = 0x00; /* Last section number=0 */ - c->operand[18] = 0x1f; /* PCR_PID=1FFF */ - c->operand[19] = 0xff; - c->operand[20] = (program_info_length >> 8); /* Program info length */ - c->operand[21] = (program_info_length & 0xff); + c->operand[12] = 0x02; /* Table id=2 */ + c->operand[13] = 0x80; /* Section syntax + length */ + /* c->operand[14] = XXXprogram_info_length + 12; */ + c->operand[15] = msg[1]; /* Program number */ + c->operand[16] = msg[2]; + c->operand[17] = 0x01; /* Version number=0 + current/next=1 */ + c->operand[18] = 0x00; /* Section number=0 */ + c->operand[19] = 0x00; /* Last section number=0 */ + c->operand[20] = 0x1f; /* PCR_PID=1FFF */ + c->operand[21] = 0xff; + c->operand[22] = (program_info_length >> 8); /* Program info length */ + c->operand[23] = (program_info_length & 0xff); /* CA descriptors at programme level */ read_pos = 6; - write_pos = 22; + write_pos = 24;