Add protection to stop opentv crashing on bad title descriptor. Relates to #1367.

diff --git a/src/epggrab/module/opentv.c b/src/epggrab/module/opentv.c
index 0778ca82bb4260f36c04d16fceed825d7d1c7ffd..e1fd6ee3f5d930774e53cc3663140d64736b525b 100644 (file)
--- a/src/epggrab/module/opentv.c
+++ b/src/epggrab/module/opentv.c
@@ -217,6 +217,8 @@ static char *_opentv_parse_string
   int ok = 0;
   char *ret, *tmp;
 
+  if (len <= 0) return NULL;
+
   // Note: unlikely decoded string will be longer (though its possible)
   ret = tmp = malloc(2*len);
   *ret = 0;
@@ -248,15 +250,17 @@ static int _opentv_parse_event_record
   if (rlen+2 <= len) {
     switch (rtag) {
       case 0xb5: // title
-        ev->start       = (((int)buf[2] << 9) | (buf[3] << 1))
-                        + mjd;
-        ev->stop        = (((int)buf[4] << 9) | (buf[5] << 1))
-                        + ev->start;
-        ev->cat         = buf[6];
-        if (prov->genre)
-          ev->cat = prov->genre->map[ev->cat];
-        if (!ev->title)
-          ev->title     = _opentv_parse_string(prov, buf+9, rlen-7);
+        if (rlen >= 7) {
+          ev->start       = (((int)buf[2] << 9) | (buf[3] << 1))
+                          + mjd;
+          ev->stop        = (((int)buf[4] << 9) | (buf[5] << 1))
+                          + ev->start;
+          ev->cat         = buf[6];
+          if (prov->genre)
+            ev->cat = prov->genre->map[ev->cat];
+          if (!ev->title)
+            ev->title     = _opentv_parse_string(prov, buf+9, rlen-7);
+        }
         break;
       case 0xb9: // summary
         if (!ev->summary)