[mythtv] Patch to avoid crash in 'ShortVirtualChannelTable' parsing

[Klaas de Waal]

On Mon, 20 Jan 2020 at 19:24, Douglas Paul <doug at bogon.ca> wrote:

> Hello,
>
> I have been sitting on this patch for a little while -- forgot about it
> completely to be honest.
>
> In the last year, one of my local ATSC channels apparently changed
> something in their systems. Previously, on their channel, they
> broadcast two streams on separate subchannels -- one 1080i/30 the other
> 480i/30.
>
> They made a change to remove the 480i subchannel. In addition, their HD
> stream now changes frequently between 10801/30 and 1080p/24 (sometimes
> every few seconds especially during commercials), probably due to some
> detection in the source material. Broke some things in my transcode flow
> but that's another subject ...
>
> When they did this, it seems they kept sending the VCT for the other
> subchannel, but it contained garbage data. This caused the parser to
> overrun a buffer and crash. It was pretty systematic after tuning that
> channel.
>
> I've attached a patch I have been using for a while to correct this
> problem, and haven't had issues since. I'm not sure if it's reproducable
> with the current signal they are broadcasting, but I could try if a
> backtrace is desired.
>
> If I remember correctly -- the crash occurred inside the MPEGDescriptor
> class because the 'end' pointer was not supplied. When this is the case,
> no bounds checking is done. There are other uses of the MPEGDescriptor
> class, and conceivably any of them could crash when there is bad data if
> the end pointer is not given in the constructor.
>
> There also seems to be a case where the same pointer is pushed into the
> m_ptrs list twice (when 'descriptors_included' is false), but I do not
> run into this case. I'm not sure if this is a problem, since I did not
> look into how this list is used.
>
> I attempted to open a ticket for this, but for some reason the Trac site
> does not like something to do with my GitHub login (I get an error
> complaining about an invalid username or password after submitting the
> form that is asking for my name to associate with my GitHub account).
>
> Thanks for your patch. I appreciate that you create the fix and take the
trouble to send it. I will look at it.
However, it would be very convenient if I can reproduce the problem and
test possible fixes myself and I can do that if you would sent me a capture
of the complete transport stream that contains the problematic channel.
This can easily be made with the "MPTS channel" option that is now in
MythTV, or with any other appliance, e.g. dvbsnoop, that can be used to
make a recording of the full transport stream. Bigger is better, if
possible then e.g. 2GB (the maximum that can be sent  for free with
WeTransfer) or e.g. 4GB (which can be sent as an email attachment to my
gmail address) would be perfect.

Thanks,
Klaas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mythtv.org/pipermail/mythtv-dev/attachments/20200120/ba64fb3f/attachment.htm>