[vdr] Re: Coredump - vdr 1.3.9 at eit.c:205

[Klaus Schmidinger <Klaus.Schmidinger@cadsoft.de>]

Philip Lawatsch wrote:
> 
> Klaus Schmidinger wrote:
> 
> >
> > I'm having the same problem. It started at around 21:45 tonight.
> > For the moment I guess turning off the EPG scan helps somewhat.
> > Maybe some channel has f***ed up their EPG data, which maybe triggers
> > a bug in VDR.
> 
> Found the problem:
> 
> in eit.c around line 200:
> 
> if (ExtendedEventDescriptors) {
>              char
> buffer[ExtendedEventDescriptors->getMaximumTextLength(": ")];
> 
> pEvent->SetDescription(ExtendedEventDescriptors->getText(buffer, ": "));
> }
> 
> The size of the buffer is too small and a buffer overflow will overwrite
> the ShortEventDescriptor and a delete will crash the whole program.

So there is either a bug in libsi, or the ZDF transponder is sending
garbled EPG data.

> ExtendedEventDescriptors->getMaximumTextLength(": ") calculates a too
> small size in my case.
> 
> Changing this to about
> 
> ExtendedEventDescriptors->getMaximumTextLength(": ")*2 solves the problem.

Maybe using a fixed 4096 would be best here, because that's the absolute
maximum ExtendedEventDescriptors->getText() can return.

> Btw, two note (no offenses !), using auto variables as buffers is bad no
> matter what since you can screw the stack.
> 
> #2 fixed size buffers are bad anyway since for instance you have
> 
> if (ShortEventDescriptor) {
>   char buffer[256];
>              pEvent->SetTitle(ShortEventDescriptor->name.getText(buffer));
> 
> pEvent->SetShortText(ShortEventDescriptor->text.getText(buffer));
>              }
> 
> Whereas getText checks for a length > 4095 or alike.

Well, IIRC the Title and ShortText can by definition only be up to 256
bytes long (including the terminating 0). But of course we could use a

  char buffer[4096];

for both cases.

> This is a source of problems imo.
> 
> And, using auto variable arrays with a "dynamic" size is a g++ only
> feature, its not protable.

Since nobody has complained about this so far, I'd say we look into
this once it becomes an actual problem.

Thanks for your debugging work. I'll try to find out more about the actual
cause of the problem tomorrow (provided the ZDF transponder still sends
garbled data then). Right now my VDR is recording...

Klaus