Opened 15 years ago

Closed 15 years ago

#1887 closed defect (fixed)

invalid PAT in recordings causes Frontend Crash, Backtrace Attached...

Reported by: jochen Owned by: danielk
Priority: minor Milestone: 0.20
Component: mythtv Version: head
Severity: medium Keywords:
Cc: Ticket locked: no


My Frontend crashes when selecting some recordings in the watch recordings screen...

Attachments (4)

gdb.txt (34.7 KB) - added by jochen 15 years ago.
mythtv-bt.txt (2.9 KB) - added by Aidan Thornton <makomk@…> 15 years ago.
ticket1887backendlog (57.0 KB) - added by psofa 15 years ago.
mythbackend -v "record,channel,file,libav,siparser"
1887-part1-v1.patch (716 bytes) - added by danielk 15 years ago.
Patch for DVBRecorder

Download all attachments as: .zip

Change History (16)

Changed 15 years ago by jochen

Attachment: gdb.txt added


comment:1 Changed 15 years ago by Aidan Thornton <makomk@…>

I encountered a similar crash on one particular DVB-T recording (the top part of the backtrace is almost exactly the same) - this was when watching the recording, and always occured at the same point in the recording. I was using SVN trunk r10088, and I suppose I'll attach my backtrace as well.

The direct cause of my crash seems to be the line "memmove(tss->section_buf, tss->section_buf+tss->section_h_size, left);" in mpegts.c:write_section_data - tss->section_buf is NULL at the time of the crash:

(gdb) print *tss
$1 = {section_index = 183, section_h_size = 16, section_buf = 0x0, check_crc = -1, end_of_section_reached = 0,
  section_cb = 0xb744079a <pat_cb>, opaque = 0x28}

Changed 15 years ago by Aidan Thornton <makomk@…>

Attachment: mythtv-bt.txt added


comment:2 Changed 15 years ago by danielk

Milestone: 0.20
Owner: changed from Isaac Richards to danielk
Version: head

comment:3 Changed 15 years ago by Janne <janne-mythtv@…>

Summary: Frontend Crash, Backtrace Attached...invalid PAT in recordings causes Frontend Crash, Backtrace Attached...

psofa from irc got a stream that crashes mythfrontend or mythtv reproducably. The backtraces look very similar to the attached. The problem in this stream is an invalid PAT.

Following block is from the mythtv output with DEBUG_SI in mpegts.c. The first 3 PAT look like this one:

00000000  00 b0 0d 00 01 c7 00 00 00 01 e4 09 fa 3f 23 d6 .............?#.
sid=0x1 sec_num=0/0
MPEG Program Number=0x1 pid=0x409 req_sid=0x1
Found program number!

But the next contains 0x00 as program number:

00000000  00 b0 0d 00 01 c9 00 00 00 01 e0 00 49 d9 e4 47 ............I..G
sid=0x1 sec_num=0/0
MPEG Program Number=0x1 pid=0x0 req_sid=0x1
New PAT!
new_service: sid=0x0001 provider='' name='MPEG Program 1'
Found program number!
Closing Filter: pid=0x409
Closing PMT Filter: pid=0x409
Opening Filter: pid=0x0
Filter Already Exists
Closing Filter: pid=0x0
Closing PAT Filter: pid=0x0
zsh: segmentation fault  mythtv -v all /pub/1747_20060601015601.mpg

this recreates the original PAT filter and the segfault is caused by a dangling pointer to the old one.

It seems that there is a race condition in the writing PAT code.

psofa sees this error while channel zapping with his DVB-S card but not with DVB-T.

comment:4 Changed 15 years ago by danielk

Hmmm, could this be related to #1872?

Janne, a race condition in the PAT writing code seems unlikely. Except at startup when we get a PAT & PMT from the signal monitor, I believe all the processing is done in a single thread.

I can fix the symptom by ignoring invalid PAT's in avlib, but we should try to figure out why this PAT is being created...

comment:5 Changed 15 years ago by Aidan Thornton <makomk@…>

This isn't actually a race condition, which is why it happens so reliably. Basically, write_section_data calls tss->section_cb - which is pat_cb - and this (incorrectly?) deletes and recreates the PAT filter, as Janne said. However, the variable tss in write_section_data still points to the now-freed filter, and when it tries to do some more stuff with it, mythfrontend segfaults. (All this happens within mpegts.c)

Changed 15 years ago by psofa

Attachment: ticket1887backendlog added

mythbackend -v "record,channel,file,libav,siparser"

comment:6 Changed 15 years ago by psofa

in the above log i started live tv on one channel.Tried to change to another and frontend died

comment:7 Changed 15 years ago by Aidan Thornton <makomk@…>

Please ignore my previous comment; while mostly correct, it's irrelevant to the problem. Sorry about that - got rather confused.

In my case, the problem occurs about half-way through the recording. Also, the program in question recorded fully - I was able to skip past the part which crashes mythfrontend and watch the rest of it fine.

comment:8 Changed 15 years ago by Stuart Auchterlonie

Looking at psofa's log file there are a number of lines of interest.

773 	2006-06-01 14:55:14.130 ProcessPAT: PAT is missing program, setting timeout
788 	2006-06-01 14:55:14.431 DVBRec(1): SetOutputPAT()
849 	2006-06-01 14:55:14.767 ProcessPAT: Good PAT seen after a bad PAT

Essentially, the backend is attempting to create the OutputPAT with the old PAT which is definitely wrong. Then the correct PAT comes through and it then processed.

Changed 15 years ago by danielk

Attachment: 1887-part1-v1.patch added

Patch for DVBRecorder

comment:9 Changed 15 years ago by danielk

psofa, I've attached a patch which may be sufficient for you to make successful recordings.

It doesn't extend MPEGStreamData to handle multiple DVB transports on a single tuned transport, nor does it fix the playback crash. But I'd appreciate if you tested this patch...

comment:10 Changed 15 years ago by psofa

It seems that the patch fixes my issue.I cant make livetv crash anymore.Thanks

comment:11 Changed 15 years ago by danielk

(In [10097]) Refs #1887. Fixes the underlaying cause of the invalid PAT in the DVB recordings which causes the reported crash.

Multiple PAT tables do not seem to be precluded in the MPEG-2 spec, but seem to have been banned in DVB-S, DVB-T, DVB-C and ATSC. But they are now allowed in DVB-S2, and have been seen in the wild.

Multiple PAT sections have always been allowed by the spec, but we haven't seen them in the wild.

This extends mpegstreamdata to allow both multiple sections per PAT table and multiple PAT tables. This changes the interface a bit, hence the changes in the other files.

I've left the ticket open because still haven't looked at having ffmpeg not crash on bad tables.

comment:12 Changed 15 years ago by danielk

Resolution: fixed
Status: newclosed

(In [10098]) Fixes #1887. Ignores invalid PAT with invalid PIDs in recorded stream, making a segfault on this type of invalid recording impossible.

Note: See TracTickets for help on using tickets.