[vdr] Re: Buffer Overflows in vdr-1.3.13

["C.Y.M" <syphir@syphir.sytes.net>]

Reinhard Nissl wrote:
> Hi,
>
> Klaus Schmidinger wrote:
>
> > If somebody would like to try this:
> >
> > --- remux.c     2004/10/16 09:11:52     1.19
> > +++ remux.c     2004/10/19 16:23:00
> > @@ -556,6 +556,11 @@
> >    int resultCount = 0;
> >    uchar *data = resultBuffer->Get(resultCount);
> >    if (data) {
> > +     if (!synced && resultCount > RESULTBUFFERSIZE * 10 / 8) {//XXX
> > +        dsyslog("clearing resultBuffer before sync");
> > +        Clear();
> > +        return NULL;
> > +        }//XXX
> >       for (int i = 0; i < resultCount - 3; i++) {
> >           if (data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1) {
> >              int l = 0;
> >
> > and let me know whether this message is ever logged, that would be
> > nice.
>
> What's the idea behind waiting for the buffer to fill up to 125 % (10 / 8)?
>
> I'd suggest the following:
>
> --- ../vdr-1.3.13-orig/remux.c  2004-10-16 11:11:52.000000000 +0200
> +++ remux.c     2004-10-21 11:51:26.693742211 +0200
> @@ -556,6 +560,11 @@
>    int resultCount = 0;
>    uchar *data = resultBuffer->Get(resultCount);
>    if (data) {
> +    if (!synced && resultBuffer->Available() > RESULTBUFFERSIZE * 8 / 
> 10) {//XXX
> +       dsyslog("clearing resultBuffer before sync");
> +       Clear();
> +       return NULL;
> +       }//XXX
>       for (int i = 0; i < resultCount - 3; i++) {
>           if (data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1) {
>              int l = 0;
>
> Like my previous patch it uses resultBuffer's Available() method to test 
> against the real buffer fill level not just the largest continuous part. 
> And I changed the test to clear the buffer when it exceeds 80 % of it's 
> capacity.
>
> Now VDR's logfile contains entries like that:
>
> Oct 21 11:53:16 video vdr[16155]: switching to channel 987
> Oct 21 11:53:16 video vdr[16191]: transfer thread ended (pid=16191, 
> tid=278537)
> Oct 21 11:53:16 video vdr[16193]: TS buffer on device 1 thread ended 
> (pid=16193, tid=311307)
> Oct 21 11:53:16 video vdr[16192]: buffer stats: 299108 (14%) used
> Oct 21 11:53:16 video vdr[16192]: receiver on device 1 thread ended 
> (pid=16192, tid=294922)
> Oct 21 11:53:16 video vdr[16155]: buffer stats: 299484 (7%) used
> Oct 21 11:53:16 video vdr[16199]: transfer thread started (pid=16199, 
> tid=327689)
> Oct 21 11:53:16 video vdr[16200]: receiver on device 1 thread started 
> (pid=16200, tid=344074)
> Oct 21 11:53:16 video vdr[16201]: TS buffer on device 1 thread started 
> (pid=16201, tid=360459)
> Oct 21 11:53:17 video vdr[16199]: clearing resultBuffer before sync
> Oct 21 11:53:21 video last message repeated 29 times
> Oct 21 11:53:21 video vdr[16199]: ERROR: no useful data seen within 
> 10607148 byte of video stream
> Oct 21 11:53:21 video vdr[16199]: clearing resultBuffer before sync
> Oct 21 11:53:23 video last message repeated 7 times
>
> Bye.
I have been testing out this patch and the crashing seems to have been 
fixed so far.. This is what I am getting is my syslog now:

Oct 21 20:00:00 poseidon vdr[1948]: file writer thread started 
(pid=1948, tid=-1318605904)
Oct 21 20:00:00 poseidon vdr[1948]: recording thread started (pid=1948, 
tid=-1264702544)
Oct 21 20:00:00 poseidon vdr[1948]: receiver on device 1 thread started 
(pid=1948, tid=-1297359952)
Oct 21 20:00:00 poseidon vdr[1948]: TS buffer on device 1 thread started 
(pid=1948, tid=-1288971344)
Oct 21 20:00:01 poseidon vdr[1948]: switching to channel 10327
Oct 21 20:00:01 poseidon vdr[1948]: info: Channel not available!
Oct 21 20:00:03 poseidon vdr[1948]: clearing resultBuffer before sync
Oct 21 20:00:03 poseidon vdr[1948]: clearing resultBuffer before sync
Oct 21 20:00:03 poseidon vdr[1948]: switching to channel 10107
Oct 21 20:00:03 poseidon vdr[1948]: transfer thread started (pid=1948, 
tid=-1326994512)
Oct 21 20:00:04 poseidon vdr[1948]: timer 5 (10107 2000-2030 'The Daily 
Show With Jon Stewart') set to event Thu 21.10.2004 20:00-20:30 'The 
Daily Show With Jon Stewart'
Oct 21 20:00:04 poseidon vdr[1948]: clearing resultBuffer before sync
Oct 21 20:00:06 poseidon last message repeated 2 times