Mailing List archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[vdr] Re: Buffer Overflows in vdr-1.3.13



C.Y.M wrote:

Klaus Schmidinger wrote:

"C.Y.M" wrote:

Can you send me a sample set of timers.conf entries with which
you can reproduce this?

Also, just to be sure: your VDR has _one_ full featured DVB card, right?

Klaus

Yes, only one FF card in my setup.  Here is an example of the
timers.conf.  Just make about 5-10 timers, 1 min long, and have them
back to back.

1:S91.0W-4100-13-106-10106:19:0900:0901:50:99:I Love Lucy:
1:S91.0W-4100-16-105-10105:19:0901:0902:50:99:Nash Bridges:
1:S82.0W-4102-211-102-10102:19:0902:0903:50:99:Paid Programming:
1:S82.0W-4102-201-347-10347:19:0903:0904:50:99:Weird Science:


I tried this and actually was able to reproduce this.
Unfortunately it didn't happen any more since I have inserted
a few lines to test something. Will try that again tomorrow.

If somebody would like to try this:

--- remux.c     2004/10/16 09:11:52     1.19
+++ remux.c     2004/10/19 16:23:00
@@ -556,6 +556,11 @@
   int resultCount = 0;
   uchar *data = resultBuffer->Get(resultCount);
   if (data) {
+     if (!synced && resultCount > RESULTBUFFERSIZE * 10 / 8) {//XXX
+        dsyslog("clearing resultBuffer before sync");
+        Clear();
+        return NULL;
+        }//XXX
      for (int i = 0; i < resultCount - 3; i++) {
          if (data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1) {
             int l = 0;

and let me know whether this message is ever logged, that would be
nice.

Klaus



Thanks for the test code. I have rebuilt vdr with this patch and now I can not seem to reproduce the buffer overflow either... Could the extra time it takes to process this new code be preventing some kind of race condition? So far I have not seen any "clearing resultBuffer before sync" messages... I'll keep testing.



My 2 cents in, I applied the patch and thought all seemed ok, so I went ahead and scheduled a few timers of shows like I normally would and let it rip. Got home and VDR was sitting on its back with legs up in the air. Here are my timers.conf and a clipping from my syslog of when it crashed.

timers.conf
27754497:S119.0W-4100-53-8891-8891:-T-----:1858:2002:99:99:NCIS:Lt. Jane Doe Series/Special. Mark Harmon, Sasha Alexander, Michael Weatherly. (2004) The team investigates a Navy lieutenant's rape and murder. (CC) (Stereo)

Syslog
Oct 19 18:58:00 HoochVDR vdr[30499]: file writer thread started (pid=30499, tid=475148)
Oct 19 18:58:00 HoochVDR vdr[30500]: recording thread started (pid=30500, tid=491533)
Oct 19 18:58:00 HoochVDR vdr[30501]: receiver on device 2 thread started (pid=30501, tid=507918)
Oct 19 18:58:00 HoochVDR vdr[30502]: TS buffer on device 2 thread started (pid=30502, tid=524303)
Oct 19 18:58:31 HoochVDR vdr[30499]: ERROR: video data stream broken
Oct 19 18:58:31 HoochVDR vdr[30499]: initiating emergency exit
Oct 19 18:58:31 HoochVDR vdr[30437]: emergency exit requested - shutting down
Oct 19 18:58:31 HoochVDR vdr[30500]: recording thread ended (pid=30500, tid=491533)
Oct 19 18:58:31 HoochVDR vdr[30502]: TS buffer on device 2 thread ended (pid=30502, tid=524303)
Oct 19 18:58:31 HoochVDR vdr[30501]: buffer stats: 26508 (1%) used
Oct 19 18:58:31 HoochVDR vdr[30501]: receiver on device 2 thread ended (pid=30501, tid=507918)
Oct 19 18:58:31 HoochVDR vdr[30499]: file writer thread ended (pid=30499, tid=475148)
Oct 19 18:58:31 HoochVDR vdr[30437]: cTS2PES got 2995 TS errors, 1186 TS continuity errors
Oct 19 18:58:31 HoochVDR vdr[30437]: cTS2PES got 141 TS errors, 141 TS continuity errors
Oct 19 18:58:31 HoochVDR vdr[30437]: cTS2PES got 148 TS errors, 141 TS continuity errors
Oct 19 18:58:31 HoochVDR vdr[30437]: buffer stats: 26884 (0%) used
Oct 19 18:58:31 HoochVDR vdr[30437]: timer 1 (9 1858-2002 'NCIS') stop
Oct 19 18:58:31 HoochVDR vdr[30467]: KBD remote control thread ended (pid=30467, tid=98311)
Oct 19 18:58:31 HoochVDR vdr[30437]: saved setup to /etc/vdr/setup.conf
Oct 19 18:58:31 HoochVDR vdr[30461]: tuner on device 1 thread ended (pid=30461,tid=16386)
Oct 19 18:58:32 HoochVDR vdr[30462]: Section handler thread ended (pid=30462, tid=32771)
Oct 19 18:58:32 HoochVDR vdr[30464]: tuner on device 2 thread ended (pid=30464,tid=49156)
Oct 19 18:58:32 HoochVDR vdr[30465]: Section handler thread ended (pid=30465, tid=65541)

Let me know if you need any more info!

Thanks!
Chad




Home | Main Index | Thread Index