From 0dfe7b545be63a90048a9c22d09465c18f904127 Mon Sep 17 00:00:00 2001
From: leslie <unknown>
Date: Sun, 16 Aug 2009 20:23:26 +0800
Subject: [PATCH] fix buffer overrun in CA info

---
 cam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cam.c b/cam.c
index 5990f2a..9732a4c 100644
--- a/cam.c
+++ b/cam.c
@@ -2200,7 +2200,7 @@ void cScCamSlot::CaInfo(int tcid, int cid)
   int n=9;
   for(int i=0; caids[i]; i++) n+=2;
   unsigned char *p;
-  if(!(p=frame.GetBuff(n))) return;
+  if(!(p=frame.GetBuff(n+(n<TDPU_SIZE_INDICATOR)?2:3))) return;
   *p++=0xa0;
   if(n<TDPU_SIZE_INDICATOR) *p++=n;
   else { *p++=2|TDPU_SIZE_INDICATOR; *p++=n>>8; *p++=n&0xFF; }
-- 
2.39.5