[SCM] kodi-pvr-vdr-vnsi/master: VNSI*: fix various endless loops

[tiber-guest at users.alioth.debian.org]

The following commit has been merged in the master branch:
commit 32973bdb835321eb44b003ed9060a13130eb5ebc
Author: Max Kellermann <max at duempel.org>
Date:   Wed Nov 4 20:50:01 2015 +0100

    VNSI*: fix various endless loops
    
    If a response packet is malformed and contains an odd number of bytes,
    extract_U32() will never consume any data, and the packet will never
    run empty.  This results in an endless loop.  Instead of checking
    cResponsePacket::end(), check for a reasonable number of remaining
    bytes.

diff --git a/src/VNSIAdmin.cpp b/src/VNSIAdmin.cpp
index f1a9610..7d93eda 100644
--- a/src/VNSIAdmin.cpp
+++ b/src/VNSIAdmin.cpp
@@ -1423,7 +1423,7 @@ bool cVNSIAdmin::ReadChannelList(bool radio)
 
   m_channels.m_channels.clear();
   m_channels.m_channelsMap.clear();
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 3 * 4 + 3)
   {
     CChannel channel;
     channel.m_blacklist = false;
@@ -1474,7 +1474,7 @@ bool cVNSIAdmin::ReadChannelWhitelist(bool radio)
 
   m_channels.m_providerWhitelist.clear();
   CProvider provider;
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 1 + 4)
   {
     char *strProviderName = vresp->extract_String();
     provider.m_name = strProviderName;
@@ -1540,7 +1540,7 @@ bool cVNSIAdmin::ReadChannelBlacklist(bool radio)
   }
 
   m_channels.m_channelBlacklist.clear();
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 4)
   {
     int id = vresp->extract_U32();
     m_channels.m_channelBlacklist.push_back(id);
diff --git a/src/VNSIChannelScan.cpp b/src/VNSIChannelScan.cpp
index dbba8b0..259066b 100644
--- a/src/VNSIChannelScan.cpp
+++ b/src/VNSIChannelScan.cpp
@@ -445,7 +445,7 @@ bool cVNSIChannelScan::ReadCountries()
   uint32_t retCode = vresp->extract_U32();
   if (retCode == VNSI_RET_OK)
   {
-    while (!vresp->end())
+    while (vresp->getRemainingLength() >= 4 + 2)
     {
       uint32_t    index     = vresp->extract_U32();
       const char *isoName   = vresp->extract_String();
@@ -481,7 +481,7 @@ bool cVNSIChannelScan::ReadSatellites()
   uint32_t retCode = vresp->extract_U32();
   if (retCode == VNSI_RET_OK)
   {
-    while (!vresp->end())
+    while (vresp->getRemainingLength() >= 4 + 2)
     {
       uint32_t    index     = vresp->extract_U32();
       const char *shortName = vresp->extract_String();
diff --git a/src/VNSIData.cpp b/src/VNSIData.cpp
index 97a79a0..633e3e3 100644
--- a/src/VNSIData.cpp
+++ b/src/VNSIData.cpp
@@ -262,7 +262,7 @@ bool cVNSIData::GetChannelsList(ADDON_HANDLE handle, bool radio)
     return false;
   }
 
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 3 * 4 + 3)
   {
     PVR_CHANNEL tag;
     memset(&tag, 0 , sizeof(tag));
@@ -317,7 +317,7 @@ bool cVNSIData::GetEPGForChannel(ADDON_HANDLE handle, const PVR_CHANNEL &channel
     return false;
   }
 
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 5 * 4 + 3)
   {
     EPG_TAG tag;
     memset(&tag, 0 , sizeof(tag));
@@ -456,7 +456,7 @@ bool cVNSIData::GetTimersList(ADDON_HANDLE handle)
   uint32_t numTimers = vresp->extract_U32();
   if (numTimers > 0)
   {
-    while (!vresp->end())
+    while (vresp->getRemainingLength() >= 12 * 4 + 1)
     {
       PVR_TIMER tag;
       memset(&tag, 0, sizeof(tag));
@@ -692,7 +692,7 @@ PVR_ERROR cVNSIData::GetRecordingsList(ADDON_HANDLE handle)
   }
 
   CStdString strRecordingId;
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 5 * 4 + 5)
   {
     PVR_RECORDING tag;
     memset(&tag, 0, sizeof(tag));
@@ -822,7 +822,8 @@ PVR_ERROR cVNSIData::GetRecordingEdl(const PVR_RECORDING& recinfo, PVR_EDL_ENTRY
   }
 
   *size = 0;
-  while (!vresp->end() && *size < PVR_ADDON_EDL_LENGTH)
+  while (vresp->getRemainingLength() >= 2 * 8 + 4 &&
+         *size < PVR_ADDON_EDL_LENGTH)
   {
     edl[*size].start = vresp->extract_S64();
     edl[*size].end = vresp->extract_S64();
@@ -874,7 +875,7 @@ PVR_ERROR cVNSIData::GetDeletedRecordingsList(ADDON_HANDLE handle)
   }
 
   CStdString strRecordingId;
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 5 * 4 + 5)
   {
     PVR_RECORDING tag;
     memset(&tag, 0, sizeof(tag));
@@ -1144,7 +1145,7 @@ bool cVNSIData::GetChannelGroupList(ADDON_HANDLE handle, bool bRadio)
     return false;
   }
 
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 1 + 1)
   {
     PVR_CHANNEL_GROUP tag;
     memset(&tag, 0, sizeof(tag));
@@ -1181,7 +1182,7 @@ bool cVNSIData::GetChannelGroupMembers(ADDON_HANDLE handle, const PVR_CHANNEL_GR
     return false;
   }
 
-  while (!vresp->end())
+  while (vresp->getRemainingLength() >= 2 * 4)
   {
     PVR_CHANNEL_GROUP_MEMBER tag;
     memset(&tag, 0, sizeof(tag));
diff --git a/src/VNSIDemux.cpp b/src/VNSIDemux.cpp
index fda3c07..a99f8af 100644
--- a/src/VNSIDemux.cpp
+++ b/src/VNSIDemux.cpp
@@ -276,7 +276,7 @@ void cVNSIDemux::StreamChange(cResponsePacket *resp)
 {
   std::vector<XbmcPvrStream> newStreams;
 
-  while (!resp->end())
+  while (resp->getRemainingLength() >= 4 + 1)
   {
     uint32_t    pid = resp->extract_U32();
     const char* type  = resp->extract_String();
@@ -389,7 +389,7 @@ void cVNSIDemux::StreamSignalInfo(cResponsePacket *resp)
 bool cVNSIDemux::StreamContentInfo(cResponsePacket *resp)
 {
   ADDON::XbmcStreamProperties streams = m_streams;
-  while (!resp->end()) 
+  while (resp->getRemainingLength() >= 4)
   {
     uint32_t pid = resp->extract_U32();
     PVR_STREAM_PROPERTIES::PVR_STREAM* props = streams.GetStreamById(pid);

-- 
kodi-pvr-vdr-vnsi packaging