[vdr] cBitmap/text2skin crash with xpm containing Windows linefeeds

Ville Skyttä vskytta at gmail.com
Thu Mar 2 22:19:00 CET 2006

I ran into a crash this week which was caused by Windows linefeeds in
a .xpm file for a skin, using text2skin.  From the backtrace (see below)
it looks like it's crashing in cBitmap::Set/LoadXpm() though.

This is a pretty much patched VDR 1.3.44 so the line numbers are
probably off wrt. vanilla.  Oh, and text2skin is 1.1 from CVS.
Converting the linefeeds to unix ones in the *.xpm file fixed the
problem.  (Yes, the troublemaker *.xpm has already been fixed in enElchi

By the way, I seem to remember that a number of apps and libraries have
recently got some xpm parsing related security updates, perhaps it would
be a good idea to review VDR's xpm loading routines against those fixes
just in case too unless someone's already done it recently...

#0  0x080cec7e in cBitmap::SetXpm (this=0xab242f8, Xpm=0x0, IgnoreNone=false)
    at osd.c:260

--> line 260 in my osd.c is the first sscanf() in SetXpm().

#1  0x080cf340 in cBitmap::LoadXpm (this=0xab242f8,
    FileName=0xab13774 "/etc/vdr/plugins/text2skin/enElchi/logos/Nelonen D.xpm") at osd.c:243

--> ...and line 243 is the Result = SetXpm(Xpm) in LoadXpm().

#2  0x00a43d86 in cText2SkinBitmap::LoadXpm (this=0xab24260,
    Filename=0xab13774 "/etc/vdr/plugins/text2skin/enElchi/logos/Nelonen D.xpm") at bitmap.c:154
#3  0x00a446ea in cText2SkinBitmap::Load (Filename=@0xb3c74544, Alpha=255,
    height=0, width=0, colors=0, Quiet=false) at bitmap.c:63
#4  0x00a3e146 in cText2SkinRender::DrawImage (this=0xa86df08,
    Pos=@0xb3c748b8, Size=@0xb3c748b0, Bg=0x0, Fg=0x0, Mask=0x0, Alpha=255,
    Colors=0, Path=@0xb3c749c4) at render.c:334
#5  0x00a3f0c9 in cText2SkinRender::DrawObject (this=0xa86df08,
    Object=0xa499288) at render.c:167
#6  0x00a3e400 in cText2SkinRender::DrawObject (this=0xa86df08,
    Object=0xa4964e8) at render.c:213
#7  0x00a3fd64 in cText2SkinRender::Update (this=0xa86df08) at render.c:151
#8  0x00a3fe17 in cText2SkinRender::Action (this=0xa86df08) at render.c:141
#9  0x080ff286 in cThread::StartThread (Thread=0xa86df08) at thread.c:243
#10 0x006ad9a0 in pthread_start_thread ()
   from /lib/obsolete/linuxthreads/i686/libpthread.so.0
#11 0x0039599a in clone () from /lib/obsolete/linuxthreads/i686/libc.so.6

More information about the vdr mailing list