SAT>IP server: RTP - fix possible NULL dereference, fixes #3386

tvheadend · Dec 6, 2015 · acf4b86 · acf4b86
1 parent aa13922
commit acf4b86
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/src/satip/rtp.c b/src/satip/rtp.c
@@ -233,14 +233,15 @@ satip_rtp_loop(satip_rtp_session_t *rtp, uint8_t *data, int len)
       TAILQ_FOREACH(tbl, &rtp->pmt_tables, link)
         if (tbl->pid == pid) {
           dvb_table_parse(&tbl->tbl, "-", data, 188, 1, 0, satip_rtp_pmt_cb);
-          if (rtp->table_data_len) {
+          if (rtp->table_data && rtp->table_data_len) {
             for (i = 0; i < rtp->table_data_len; i += 188) {
               r = satip_rtp_append_data(rtp, &v, rtp->table_data + i);
               if (r < 0)
                 return r;
             }
             free(rtp->table_data);
             rtp->table_data = NULL;
+            rtp->table_data_len = 0;
           }
           break;
         }
@@ -319,10 +320,11 @@ satip_rtp_tcp_loop(satip_rtp_session_t *rtp, uint8_t *data, int len)
       TAILQ_FOREACH(tbl, &rtp->pmt_tables, link)
         if (tbl->pid == pid) {
           dvb_table_parse(&tbl->tbl, "-", data, 188, 1, 0, satip_rtp_pmt_cb);
-          if (rtp->table_data_len) {
+          if (rtp->table_data && rtp->table_data_len) {
             satip_rtp_append_tcp_data(rtp, rtp->table_data, rtp->table_data_len);
             free(rtp->table_data);
             rtp->table_data = NULL;
+            rtp->table_data_len = 0;
           }
           break;
         }