tvhcsa: add invalid offset check for CSA descramble

diff --git a/src/descrambler/tvhcsa.c b/src/descrambler/tvhcsa.c
index 259882e7eb3d5619358baaa0f6c2b4e54d4d3f7c..31b906d01f076a42778392c73dbf7d2b42288b42 100644 (file)
--- a/src/descrambler/tvhcsa.c
+++ b/src/descrambler/tvhcsa.c
@@ -122,6 +122,8 @@ tvhcsa_csa_cbc_descramble
      pkt[3] &= 0x3f;  // consider it decrypted now
      if(pkt[3] & 0x20) { // incomplete packet
        offset = 4 + pkt[4] + 1;
+       if (offset > 187) // invalid offset
+         break;
        len = 188 - offset;
        n = len >> 3;
        // FIXME: //residue = len - (n << 3);