Opened 7 years ago

Closed 5 years ago

#11844 closed Patch - Bug Fix (fixed)

Negative values in Services API requests can cause segfaults

Reported by: Bill Meek <keemllib@…> Owned by: paulh
Priority: minor Milestone: 0.28
Component: MythTV - Services API - Backend Version: Master Head
Severity: medium Keywords:
Cc: Ticket locked: no


To Duplicate

Start the backend with -v upnp (just for detail)
From a browser send:

Backtrace/version and backend log attached.

Obvious workaround, don't send negative values.

I'd be glad to add a patch that takes the absolute value of nStartIndex and nCount, or range checkes their values.

But that only solves this case. Suggest that no input should crash the BE.

Attachments (3)

gdb-mythbackend-20903.txt (65.8 KB) - added by Bill Meek <keemllib@…> 7 years ago.
BT on v0.28-pre-84-g5b6f322
mythbackend.20130911180803.20903.log (9.9 KB) - added by Bill Meek <keemllib@…> 7 years ago.
NegativeStartIndexGuard.patch.v0 (4.0 KB) - added by Bill Meek <<keemllib@…> 5 years ago.

Download all attachments as: .zip

Change History (7)

Changed 7 years ago by Bill Meek <keemllib@…>

Attachment: gdb-mythbackend-20903.txt added

BT on v0.28-pre-84-g5b6f322

Changed 7 years ago by Bill Meek <keemllib@…>

Changed 5 years ago by Bill Meek <<keemllib@…>

comment:1 Changed 5 years ago by Bill Meek <keemllib@…>

Added fixes for all StartIndex? parameters to prevent a -1 value from causing a segfault. Not sure why it exists in Channel::GetChannelInfoList? because it doesn't seem to have any affect. Tested on v0.28-pre-3221-g7292e21 with values of -1, 0, 1 and no StartIndex? parameter.

comment:2 Changed 5 years ago by Karl Egly

Milestone: unknown0.28
Type: Bug Report - CrashPatch - Bug Fix

comment:3 Changed 5 years ago by paulh

Owner: set to paulh
Status: newaccepted

comment:4 Changed 5 years ago by Bill Meek <keemllib@…>

Resolution: fixed
Status: acceptedclosed

In 7b465535c17056a12b5bbec60082f4b0e63695a2/mythtv:

Services API: Fix negative StartIndex? values causing segfaults

Fixes #11844.

Signed-off-by: Paul Harrison <pharrison@…>

Note: See TracTickets for help on using tickets.