[vdr] Re: Coredump - vdr 1.3.9 at eit.c:205

[Klaus Schmidinger <Klaus.Schmidinger@cadsoft.de>]

Philip Lawatsch wrote:
> 
> Klaus Schmidinger wrote:
> 
> >
> > I'm having the same problem. It started at around 21:45 tonight.
> > For the moment I guess turning off the EPG scan helps somewhat.
> > Maybe some channel has f***ed up their EPG data, which maybe triggers
> > a bug in VDR.
> 
> Found the problem:
> 
> in eit.c around line 200:
> 
> if (ExtendedEventDescriptors) {
>              char
> buffer[ExtendedEventDescriptors->getMaximumTextLength(": ")];
> 
> pEvent->SetDescription(ExtendedEventDescriptors->getText(buffer, ": "));
> }
> 
> The size of the buffer is too small and a buffer overflow will overwrite
> the ShortEventDescriptor and a delete will crash the whole program.
> 
> ExtendedEventDescriptors->getMaximumTextLength(": ") calculates a too
> small size in my case.

Just curious: when you wre debugging this, did you see the actual value that
was returned by getMaximumTextLength()? And did you also see the actual string
returned by getText()?

My guess would be that the buffer was just one byte too small, because
getMaximumTextLength() returns the length of the string, without the terminating
'\0'. So maybe just increasing the buffer size by 1 would have done the trick.
Unfortunately the problem doesn't happen any more today, so it's hard to find
out what was really going on.

Klaus