From 3f74523d2e26db3de42d61a51dc7f5f20112a9df Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela Date: Sun, 14 Oct 2018 00:03:19 +0200 Subject: [PATCH] cwc: fix the wrong memory access in cwc_send_msg()/des, fixes #4888 --- src/descrambler/cwc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/descrambler/cwc.c b/src/descrambler/cwc.c index 6d9a99b19..0ff705348 100644 --- a/src/descrambler/cwc.c +++ b/src/descrambler/cwc.c @@ -225,8 +225,8 @@ cwc_send_msg(void *cc, const uint8_t *msg, size_t len, if (len < 3) return -1; - /* note: the last 10 bytes is pad/checksum for des_encrypt() */ - cm = malloc(sizeof(cc_message_t) + 12 + len + 10); + /* note: the last 16 bytes is pad/checksum for des_encrypt() */ + cm = malloc(sizeof(cc_message_t) + 12 + len + 16); if (cm == NULL) return -1; -- 2.47.2