cwc: fix the wrong memory access in cwc_send_msg()/des, fixes #4888

diff --git a/src/descrambler/cwc.c b/src/descrambler/cwc.c
index 6d9a99b19fee189ef36190af05c12ea4b490cbf7..0ff7053484a500b05a258ca8f7ec249469f51759 100644 (file)
--- a/src/descrambler/cwc.c
+++ b/src/descrambler/cwc.c
@@ -225,8 +225,8 @@ cwc_send_msg(void *cc, const uint8_t *msg, size_t len,
   if (len < 3)
     return -1;
 
-  /* note: the last 10 bytes is pad/checksum for des_encrypt() */
-  cm = malloc(sizeof(cc_message_t) + 12 + len + 10);
+  /* note: the last 16 bytes is pad/checksum for des_encrypt() */
+  cm = malloc(sizeof(cc_message_t) + 12 + len + 16);
 
   if (cm == NULL)
     return -1;