[vdr] Re: Nasty bug in StillPicture()

[Thomas Heiligenmann <thomas@heiligenmann.de>]

Klaus Schmidinger schrieb:
> Oliver Endriss wrote:
>
> > On Saturday 18 October 2003 17:48, Thomas Heiligenmann wrote:
> >
> > > Oliver Endriss schrieb:
> > >
> > > > On Saturday 18 October 2003 14:57, Thomas Heiligenmann wrote:
> > > >
> > > >
> > > > > Oops - just seen it. Here comes the updated patch :-)
> > > >
> > > > I suggest to stop scanning immediately if we encounter an error.
> > > > For example (MPEG-2 case):
> > > >
> > > >              if ((Data[i + 6] & 0xC0) == 0x80) {
> > > >                 // MPEG-2 PES header
> > > >                 if (i + 8 >= Length)
> > > >                    break;
> > > >                 offs += 3;
> > > >                 offs += Data[i + 8];
> > > >                 len -= 3;
> > > >                 len -= Data[i + 8];
> > > >                 if (len < 0 || offs + len >= Length)
> > > >                    break;
> > > >                 }
> > > >              else {
> > > >                 // MPEG-1 PES header
> > > >                 ...
> > > Wouldn't it be better then to "return" immediately? After "break"-ing
> > > the "while" loop a part of the (erratic) stream would be sent to the
> > > driver anyway.
> > >
> > > if (len < 0 || offs + len >= Length) {
> > >   free(buf);
> > >   return;
> > >   }
> > > ...
> > IIRC, these extensions are only included in the first PES header of a
> > picture. If we use 'return' we enforce that data must be passed
> > correctly. We don't accept garbled data in the buffer. (If the first
> > extension header is garbled there is no difference.)
> >
> > If we use 'break' we are a little bit more liberal in what we accept.
> > Maybe the decoder can do something useful with the data processed so far.
> > IMHO, displaying a partial picture might be better that doing nothing.
> >
> > Oliver
>
> Since I don't have too much time to test this stuff today, can you
> folks please agree on a patch against VDR 1.2.6pre1 that I can apply
> for a 1.2.6pre2 to be uploaded today?
>
> Klaus
Let's try the "break" solution and see how the driver deals with garbled 
streams. The attached patch works fine with MPEG-1 and MPEG-2 stuff I've 
tested.

Thomas
--- dvbdevice.c.orig	2003-10-17 17:36:13.000000000 +0200
+++ dvbdevice.c	2003-10-19 13:16:17.000000000 +0200
@@ -957,10 +957,14 @@
                  // skip header extension
                  if ((Data[i + 6] & 0xC0) == 0x80) {
                     // MPEG-2 PES header
+                    if (Data[i + 8] >= Length)
+                       break;
                     offs += 3;
                     offs += Data[i + 8];
                     len -= 3;
                     len -= Data[i + 8];
+                    if (len < 0 || offs + len >= Length)
+                       break;
                     }
                  else {
                     // MPEG-1 PES header
@@ -968,19 +972,19 @@
                           offs++;
                           len--;
                           }
-                    if ((Data[offs] & 0xC0) == 0x40) {
+                    if (offs <= Length - 2 && len >= 2 && (Data[offs] & 0xC0) == 0x40) {
                        offs += 2;
                        len -= 2;
                        }
-                    if ((Data[offs] & 0xF0) == 0x20) {
+                    if (offs <= Length - 5 && len >= 5 && (Data[offs] & 0xF0) == 0x20) {
                        offs += 5;
                        len -= 5;
                        }
-                    else if ((Data[offs] & 0xF0) == 0x30) {
+                    else if (offs <= Length - 10 && len >= 10 && (Data[offs] & 0xF0) == 0x30) {
                        offs += 10;
                        len -= 10;
                        }
-                    else if (Data[offs] == 0x0F) {
+                    else if (offs < Length && len > 0) {
                        offs++;
                        len--;
                        }