[vdr] Re: Coredump - vdr 1.3.9 at eit.c:205

[Philip Lawatsch <philip@lawatsch.at>]

Klaus Schmidinger wrote:


> I'm having the same problem. It started at around 21:45 tonight.
> For the moment I guess turning off the EPG scan helps somewhat.
> Maybe some channel has f***ed up their EPG data, which maybe triggers
> a bug in VDR.
Found the problem:


in eit.c around line 200:

if (ExtendedEventDescriptors) {
            char 
buffer[ExtendedEventDescriptors->getMaximumTextLength(": ")];

pEvent->SetDescription(ExtendedEventDescriptors->getText(buffer, ": "));
}


The size of the buffer is too small and a buffer overflow will overwrite 
the ShortEventDescriptor and a delete will crash the whole program.


ExtendedEventDescriptors->getMaximumTextLength(": ") calculates a too 
small size in my case.

Changing this to about

ExtendedEventDescriptors->getMaximumTextLength(": ")*2 solves the problem.

Btw, two note (no offenses !), using auto variables as buffers is bad no 
matter what since you can screw the stack.

#2 fixed size buffers are bad anyway since for instance you have

if (ShortEventDescriptor) {
 char buffer[256];
            pEvent->SetTitle(ShortEventDescriptor->name.getText(buffer));

pEvent->SetShortText(ShortEventDescriptor->text.getText(buffer));
            }

Whereas getText checks for a length > 4095 or alike.

This is a source of problems imo.

And, using auto variable arrays with a "dynamic" size is a g++ only 
feature, its not protable.

kind regards Philip