Opened 12 years ago

Closed 12 years ago

#4097 closed defect (fixed)

Backend Segfaults after an invalid return by ProgramAssociationTable class.

Reported by: wleibe Owned by: danielk
Priority: minor Milestone: 0.21
Component: dvb Version: head
Severity: medium Keywords:
Cc: Ticket locked: no

Description

Please see the bt for the debug data.

After a review of the code I found that ProgramCount? in mpegtables.h was returning a very large number from an invalid subtraction operation. (Subtraction below zero)

I applied the patch to my code and I have not had a seg fault for 4 days. (Before the patch I would seg fault every 4 to 8 hours.)

I'm not sure of the component so I put it under mythtv.

Attachments (2)

segfaultBT.txt (2.7 KB) - added by anonymous 12 years ago.
myth_segfault.diff.txt (967 bytes) - added by anonymous 12 years ago.

Download all attachments as: .zip

Change History (7)

Changed 12 years ago by anonymous

Attachment: segfaultBT.txt added

Changed 12 years ago by anonymous

Attachment: myth_segfault.diff.txt added

comment:1 Changed 12 years ago by danielk

Component: mythtvdvb
Owner: changed from Isaac Richards to danielk
Severity: highmedium

comment:2 Changed 12 years ago by danielk

Milestone: unknown0.21
Status: newassigned

comment:3 Changed 12 years ago by danielk

Resolution: fixed
Status: assignedclosed

Somehow the trac hook didn't catch this in [14737]..

Fixes #4097. Adds a little sanity checking to ProgramAssociationTable::ProgramCount??().

This sanity checking is only really needed because we allow bypassing the CRC check on PAT tables with some broken hardware, but there is also the theoretical possibility that a broadcaster sends out malformed data in which case this will prevent it from causing an illegal memory access.

comment:4 Changed 12 years ago by wleibe

Resolution: fixed
Status: closedreopened

Hello,

I was just curious about one thing. After I found this bug I also noticed that DescriptorsLength? in mpegtables.h has the same problem. Can we add the same sanity checking to this function as well?

comment:5 Changed 12 years ago by danielk

Resolution: fixed
Status: reopenedclosed

Different problem == new ticket. BTW Please attach a "mythbackend -v record,siparser,channel" log, I'm curious as to whether we can't just enable CRC checking for your hardware and do away with the problem altogether.

Note: See TracTickets for help on using tickets.