I ran into a crash this week which was caused by Windows linefeeds in a .xpm file for a skin, using text2skin. From the backtrace (see below) it looks like it's crashing in cBitmap::Set/LoadXpm() though.
This is a pretty much patched VDR 1.3.44 so the line numbers are probably off wrt. vanilla. Oh, and text2skin is 1.1 from CVS. Converting the linefeeds to unix ones in the *.xpm file fixed the problem. (Yes, the troublemaker *.xpm has already been fixed in enElchi 0.7.1.)
By the way, I seem to remember that a number of apps and libraries have recently got some xpm parsing related security updates, perhaps it would be a good idea to review VDR's xpm loading routines against those fixes just in case too unless someone's already done it recently...
#0 0x080cec7e in cBitmap::SetXpm (this=0xab242f8, Xpm=0x0, IgnoreNone=false) at osd.c:260
--> line 260 in my osd.c is the first sscanf() in SetXpm().
#1 0x080cf340 in cBitmap::LoadXpm (this=0xab242f8, FileName=0xab13774 "/etc/vdr/plugins/text2skin/enElchi/logos/Nelonen D.xpm") at osd.c:243
--> ...and line 243 is the Result = SetXpm(Xpm) in LoadXpm().
#2 0x00a43d86 in cText2SkinBitmap::LoadXpm (this=0xab24260, Filename=0xab13774 "/etc/vdr/plugins/text2skin/enElchi/logos/Nelonen D.xpm") at bitmap.c:154 #3 0x00a446ea in cText2SkinBitmap::Load (Filename=@0xb3c74544, Alpha=255, height=0, width=0, colors=0, Quiet=false) at bitmap.c:63 #4 0x00a3e146 in cText2SkinRender::DrawImage (this=0xa86df08, Pos=@0xb3c748b8, Size=@0xb3c748b0, Bg=0x0, Fg=0x0, Mask=0x0, Alpha=255, Colors=0, Path=@0xb3c749c4) at render.c:334 #5 0x00a3f0c9 in cText2SkinRender::DrawObject (this=0xa86df08, Object=0xa499288) at render.c:167 #6 0x00a3e400 in cText2SkinRender::DrawObject (this=0xa86df08, Object=0xa4964e8) at render.c:213 #7 0x00a3fd64 in cText2SkinRender::Update (this=0xa86df08) at render.c:151 #8 0x00a3fe17 in cText2SkinRender::Action (this=0xa86df08) at render.c:141 #9 0x080ff286 in cThread::StartThread (Thread=0xa86df08) at thread.c:243 #10 0x006ad9a0 in pthread_start_thread () from /lib/obsolete/linuxthreads/i686/libpthread.so.0 #11 0x0039599a in clone () from /lib/obsolete/linuxthreads/i686/libc.so.6