[gelöst] VDR coredump und Speicherverletzungen beim Umschalten (patch für <1.7.23 enthalten)

valgrind --log-file=/tmp/valgrind.log --track-origins=yes --leak-check=yes /usr/bin/vdr --log=0 --plugin="streamdev-client" --plugin="dummydevice"
while true; do for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 19 20 21 22 23 24 25 26 28 29 30 31; do svdrpsend.pl chan $i; sleep 0.5s; done; done
while true; do svdrpsend.pl chan 1; sleep 0.5s; done
==30948== Memcheck, a memory error detector
==30948== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==30948== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==30948== Command: /usr/bin/vdr --log=0 --plugin=streamdev-client --plugin=dummydevice
==30948== Parent PID: 3593
==30948== 
==30948== Thread 7:
==30948== Invalid write of size 2
==30948==    at 0x4A0A640: memcpy@GLIBC_2.2.5 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==30948==    by 0x4BAC51: cTsToPes::GetPes(int&) (in /usr/bin/vdr)
==30948==    by 0x46B3CA: cDevice::PlayTsVideo(unsigned char const*, int) (in /u
sr/bin/vdr)
==30948==    by 0x46AFF1: cDevice::PlayTs(unsigned char const*, int, bool) (in /usr/bin/vdr)
==30948==    by 0x4DB3BA: cTransfer::Receive(unsigned char*, int) (in /usr/bin/vdr)
==30948==    by 0x46DD22: cDevice::Action() (in /usr/bin/vdr)
==30948==    by 0x4D3087: cThread::StartThread(cThread*) (in /usr/bin/vdr)
==30948==    by 0x377A207DFB: start_thread (in /lib64/libpthread-2.14.1.so)
==30948==    by 0x37796EC21C: clone (in /lib64/libc-2.14.1.so)
==30948==  Address 0x11b2fb7e is 2 bytes before a block of size 302,008 alloc'd
==30948==    at 0x4A09042: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==30948==    by 0x4BAA7F: cTsToPes::PutTs(unsigned char const*, int) (in /usr/bin/vdr)
==30948==    by 0x46B42D: cDevice::PlayTsVideo(unsigned char const*, int) (in /usr/bin/vdr)
==30948==    by 0x46AFF1: cDevice::PlayTs(unsigned char const*, int, bool) (in /usr/bin/vdr)
==30948==    by 0x4DB3BA: cTransfer::Receive(unsigned char*, int) (in /usr/bin/vdr)
==30948==    by 0x46DD22: cDevice::Action() (in /usr/bin/vdr)
==30948==    by 0x4D3087: cThread::StartThread(cThread*) (in /usr/bin/vdr)
==30948==    by 0x377A207DFB: start_thread (in /lib64/libpthread-2.14.1.so)
==30948==    by 0x37796EC21C: clone (in /lib64/libc-2.14.1.so)
==30948== 
==30948== 
==30948== HEAP SUMMARY:
==30948==     in use at exit: 300,273 bytes in 1,091 blocks
==30948==   total heap usage: 1,359,082 allocs, 1,357,991 frees, 910,033,885 bytes allocated
==30948== 
==30948== LEAK SUMMARY:
==30948==    definitely lost: 0 bytes in 0 blocks
==30948==    indirectly lost: 0 bytes in 0 blocks
==30948==      possibly lost: 0 bytes in 0 blocks
==30948==    still reachable: 300,273 bytes in 1,091 blocks
==30948==         suppressed: 0 bytes in 0 blocks
==30948== Reachable blocks (those to which a pointer was found) are not shown.
==30948== To see them, rerun with: --leak-check=full --show-reachable=yes
==30948== 
==30948== For counts of detected and suppressed errors, rerun with: -v
==30948== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 10 from 8)

--- remux.c.orig        2012-01-12 10:08:11.388006000 +0100
+++ remux.c     2012-01-12 10:11:14.245006788 +0100
@@ -700,8 +700,13 @@
      if (offset) {
         uchar *p = data + offset - 6;
         if (p != data) {
-           p -= 3;
-           memmove(p, data, 4);
+          if (p - 3 < data) {
+              esyslog("ERROR: pointer before data offset=%d", offset);
+             }
+          else {
+             p -= 3;
+             memmove(p, data, 4);
+             }
            }
         int l = min(length - offset, MAXPESLENGTH);
         offset += l;
--- remux.c.orig        2012-01-12 10:08:11.388006000 +0100
+++ remux.c     2012-01-12 10:11:14.245006788 +0100
@@ -700,8 +700,13 @@
      if (offset) {
         uchar *p = data + offset - 6;
         if (p != data) {
-           p -= 3;
-           memmove(p, data, 4);
+          if (p - 3 < data) {
+              esyslog("ERROR: pointer before data offset=%d", offset);
+             }
+          else {
+             p -= 3;
+             memmove(p, data, 4);
+             }
            }
         int l = min(length - offset, MAXPESLENGTH);
         offset += l;
--- remux.c     2011/09/04 13:09:06     2.62
+++ remux.c     2012/01/12 12:07:58
@@ -701,6 +701,10 @@
         uchar *p = data + offset - 6;
         if (p != data) {
            p -= 3;
+           if (p < data) {
+              Reset();
+              return NULL;
+              }
            memmove(p, data, 4);
            }
         int l = min(length - offset, MAXPESLENGTH);

[gelöst] VDR coredump und Speicherverletzungen beim Umschalten (patch für <1.7.23 enthalten)

Jetzt mitmachen!

Teilen