From: Jaroslav Kysela <perex@perex.cz>
Date: Sat, 13 Oct 2018 22:03:19 +0000 (+0200)
Subject: cwc: fix the wrong memory access in cwc_send_msg()/des, fixes #4888
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3f74523d2e26db3de42d61a51dc7f5f20112a9df;p=thirdparty%2Ftvheadend.git

cwc: fix the wrong memory access in cwc_send_msg()/des, fixes #4888
---

diff --git a/src/descrambler/cwc.c b/src/descrambler/cwc.c
index 6d9a99b19..0ff705348 100644
--- a/src/descrambler/cwc.c
+++ b/src/descrambler/cwc.c
@@ -225,8 +225,8 @@ cwc_send_msg(void *cc, const uint8_t *msg, size_t len,
   if (len < 3)
     return -1;
 
-  /* note: the last 10 bytes is pad/checksum for des_encrypt() */
-  cm = malloc(sizeof(cc_message_t) + 12 + len + 10);
+  /* note: the last 16 bytes is pad/checksum for des_encrypt() */
+  cm = malloc(sizeof(cc_message_t) + 12 + len + 16);
 
   if (cm == NULL)
     return -1;