[vdr] Re: Buffer Overflows in vdr-1.3.13

[Reinhard Nissl <rnissl@gmx.de>]

Hi,

Klaus Schmidinger wrote:

> If somebody would like to try this:
>
> --- remux.c     2004/10/16 09:11:52     1.19
> +++ remux.c     2004/10/19 16:23:00
> @@ -556,6 +556,11 @@
>    int resultCount = 0;
>    uchar *data = resultBuffer->Get(resultCount);
>    if (data) {
> +     if (!synced && resultCount > RESULTBUFFERSIZE * 10 / 8) {//XXX
> +        dsyslog("clearing resultBuffer before sync");
> +        Clear();
> +        return NULL;
> +        }//XXX
>       for (int i = 0; i < resultCount - 3; i++) {
>           if (data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1) {
>              int l = 0;
>
> and let me know whether this message is ever logged, that would be
> nice.
What's the idea behind waiting for the buffer to fill up to 125 % (10 / 8)?

I'd suggest the following:

--- ../vdr-1.3.13-orig/remux.c  2004-10-16 11:11:52.000000000 +0200
+++ remux.c     2004-10-21 11:51:26.693742211 +0200
@@ -556,6 +560,11 @@
   int resultCount = 0;
   uchar *data = resultBuffer->Get(resultCount);
   if (data) {
+    if (!synced && resultBuffer->Available() > RESULTBUFFERSIZE * 8 / 10) {//XXX
+       dsyslog("clearing resultBuffer before sync");
+       Clear();
+       return NULL;
+       }//XXX
      for (int i = 0; i < resultCount - 3; i++) {
          if (data[i] == 0 && data[i + 1] == 0 && data[i + 2] == 1) {
             int l = 0;

Like my previous patch it uses resultBuffer's Available() method to test 
against the real buffer fill level not just the largest continuous part. And I 
changed the test to clear the buffer when it exceeds 80 % of it's capacity.

Now VDR's logfile contains entries like that:

Oct 21 11:53:16 video vdr[16155]: switching to channel 987
Oct 21 11:53:16 video vdr[16191]: transfer thread ended (pid=16191, tid=278537)
Oct 21 11:53:16 video vdr[16193]: TS buffer on device 1 thread ended 
(pid=16193, tid=311307)
Oct 21 11:53:16 video vdr[16192]: buffer stats: 299108 (14%) used
Oct 21 11:53:16 video vdr[16192]: receiver on device 1 thread ended 
(pid=16192, tid=294922)
Oct 21 11:53:16 video vdr[16155]: buffer stats: 299484 (7%) used
Oct 21 11:53:16 video vdr[16199]: transfer thread started (pid=16199, tid=327689)
Oct 21 11:53:16 video vdr[16200]: receiver on device 1 thread started 
(pid=16200, tid=344074)
Oct 21 11:53:16 video vdr[16201]: TS buffer on device 1 thread started 
(pid=16201, tid=360459)
Oct 21 11:53:17 video vdr[16199]: clearing resultBuffer before sync
Oct 21 11:53:21 video last message repeated 29 times
Oct 21 11:53:21 video vdr[16199]: ERROR: no useful data seen within 10607148 
byte of video stream
Oct 21 11:53:21 video vdr[16199]: clearing resultBuffer before sync
Oct 21 11:53:23 video last message repeated 7 times

Bye.
--
Dipl.-Inform. (FH) Reinhard Nissl
mailto:rnissl@gmx.de