sys/dvb/camutils.c: Extra checks to prevent data corruption/segfaults.

Original commit message from CVS:
* sys/dvb/camutils.c:
Extra checks to prevent data corruption/segfaults.

1 files changed, 18 insertions, 12 deletions

diff --git a/sys/dvb/camutils.c b/sys/dvb/camutils.c
index 1eb32175..b58eca1a 100644
--- a/sys/dvb/camutils.c
+++ b/sys/dvb/camutils.c
@@ -232,12 +232,14 @@ cam_build_ca_pmt (GstStructure * pmt, guint8 list_management, guint8 cmd_id,
   streams = gst_structure_get_value (pmt, "streams");
   value = gst_structure_get_value (pmt, "descriptors");
   if (value != NULL) {
-    program_descriptors = g_value_get_boxed (value);
-    /* get the length of program level CA_descriptor()s */
-    len = get_ca_descriptors_length (program_descriptors);
-    if (len > 0)
-      /* add one byte for the program level cmd_id */
-      len += 1;
+    if (G_VALUE_HOLDS_BOXED (value)) {
+      program_descriptors = g_value_get_boxed (value);
+      /* get the length of program level CA_descriptor()s */
+      len = get_ca_descriptors_length (program_descriptors);
+      if (len > 0)
+        /* add one byte for the program level cmd_id */
+        len += 1;
+    }
   }
   lengths = g_list_append (lengths, GINT_TO_POINTER (len));
   body_size += 6 + len;
@@ -249,12 +251,16 @@ cam_build_ca_pmt (GstStructure * pmt, guint8 list_management, guint8 cmd_id,
       stream = g_value_get_boxed (value);
 
       value = gst_structure_get_value (stream, "descriptors");
-      stream_descriptors = g_value_get_boxed (value);
-
-      len = get_ca_descriptors_length (stream_descriptors);
-      if (len > 0)
-        /* one byte for the stream level cmd_id */
-        len += 1;
+      if (value != NULL) {
+        if (G_VALUE_HOLDS_BOXED (value)) {
+          stream_descriptors = g_value_get_boxed (value);
+
+          len = get_ca_descriptors_length (stream_descriptors);
+          if (len > 0)
+            /* one byte for the stream level cmd_id */
+            len += 1;
+        }
+      }
 
       lengths = g_list_append (lengths, GINT_TO_POINTER (len));
       body_size += 5 + len;