[mythtv-commits] Ticket #13263: Crash in ProgramMapTable::Create

[MythTV]

#13263: Crash in ProgramMapTable::Create
------------------------------------+-------------------------
     Reporter:  Gary Buhrmaster     |      Owner:  (none)
         Type:  Bug Report - Crash  |     Status:  new
     Priority:  minor               |  Milestone:  unknown
    Component:  MythTV - General    |    Version:  Unspecified
     Severity:  medium              |   Keywords:  gcc8
Ticket locked:  0                   |
------------------------------------+-------------------------
 Abort in libmythtv due to accessing beyond the size of the vector.

 With at least some recording sources (I am using an OCUR device) it is
 apparently possible to end up having zero descriptors in the stream when
 ProgramMapTable::Create is called, but GCC 8 (and libstdc++) now includes
 AddressSanitizer integration for std::vector, detecting out-of-range
 accesses to a vector, which means that referencing the 0th element is now
 an error (and an abort) even though the called code would not typically
 copy any data.

 Proposed (lightly tested (it no longer crashes!)) fix follows to simply
 not try to copy from an empty vector to avoid the abort.

 It accepted, this will likely need to be backported to fixes/29 (and maybe
 fixes/0.28 if that is still considered supported).

 I suspect there is other places in the code where this will need to be
 fixed (when it rains, it pours).

 Proposed patch:

 {{{
 diff --git a/mythtv/libs/libmythtv/mpeg/mpegtables.cpp
 b/mythtv/libs/libmythtv/mpeg/mpegtables.cpp
 index 3120b821f6..296e3a3416 100644
 --- a/mythtv/libs/libmythtv/mpeg/mpegtables.cpp
 +++ b/mythtv/libs/libmythtv/mpeg/mpegtables.cpp
 @@ -445,7 +445,8 @@ ProgramMapTable* ProgramMapTable::Create(
          uint len = global_desc[i][1] + 2;
          gdesc.insert(gdesc.end(), global_desc[i], global_desc[i] + len);
      }
 -    pmt->SetProgramInfo(&gdesc[0], gdesc.size());
 +    if (!gdesc.empty())
 +        pmt->SetProgramInfo(&gdesc[0], gdesc.size());

      for (uint i = 0; i < count; i++)
      {
 @@ -457,7 +458,8 @@ ProgramMapTable* ProgramMapTable::Create(
                           prog_desc[i][j], prog_desc[i][j] + len);
          }

 -        pmt->AppendStream(pids[i], types[i], &pdesc[0], pdesc.size());
 +        if (!pdesc.empty())
 +            pmt->AppendStream(pids[i], types[i], &pdesc[0],
 pdesc.size());
      }
      pmt->Finalize();

 }}}

-- 
Ticket URL: <https://code.mythtv.org/trac/ticket/13263>
MythTV <http://www.mythtv.org>
MythTV Media Center