Project

General

Profile

Bug #3386

SAT > IP and severside decryption

Added by Tux Droid over 6 years ago. Updated over 6 years ago.

Status:
Fixed
Priority:
Normal
Assignee:
-
Category:
SAT>IP
Target version:
-
Start date:
2015-12-06
Due date:
% Done:

100%

Estimated time:
Found in version:
4.1-1171~gaa13922
Affected Versions:

Description

Hello,

just found a possible bug in TVH.

TVH is crashing with:

Dec  5 21:49:12 satip-server-71 tvheadend[29349]: subscription: 0029: "SAT>IP" subscribing to mux "10971.41H", weight: 100, adapter: "STV090x Multistandard : DVB-S #3", network: "13.0E", service: "Raw PID Subscription", hostname="192.168.1.73", client="vdr-satip/2.2.3 (device 0)" 
Dec  5 21:49:13 satip-server-71 tvheadend[29349]: capmt: minisatip: Starting CAPMT server for service "SRF 1 HD" on adapter 3
Dec  5 21:49:13 satip-server-71 tvheadend[29349]: subscription: 002E: "SAT>IP Slave/13.0E/10971.41H/SRF 1 HD" subscribing to service "13.0E/10971.41H/SRF 1 HD", weight: 100, adapter: "STV090x Multistandard : DVB-S #3", network: "13.0E", mux: "10971.41H", provider: "Schweizer Radio und Fernsehen", client="SAT>IP Slave/13.0E/10971.41H/SRF 1 HD" 
Dec  5 21:49:14 satip-server-71 tvheadend[29349]: mpegts: 10971.41H in 13.0E scan complete
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: linuxdvb: STV090x Multistandard : DVB-S #0 - read() EOVERFLOW
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: linuxdvb: STV090x Multistandard : DVB-S #1 - read() EOVERFLOW
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: linuxdvb: STV090x Multistandard : DVB-S #2 - read() EOVERFLOW
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: linuxdvb: STV090x Multistandard : DVB-S #3 - read() EOVERFLOW
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: Signal: 11 in PRG: tvheadend (4.1-1171~gaa13922) [48d72f5e938ad0d99bdd488f2e59c3aa48534bcc] CWD: /  
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: Fault address (nil) (Address not mapped)
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: Loaded libraries: /usr/lib/libdvben50221.so /usr/lib/libdvbapi.so /usr/lib/libucsi.so /lib/x86_64-linux-gnu/libssl.so.1.0.0 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 /lib/x86_64-linux-gnu/libz.so.1 /usr/lib/liburiparser.so.1 /usr/lib/x86_64-linux-gnu/libavahi-common.so.3 /usr/lib/x86_64-linux-gnu/libavahi-client.so.3 /lib/x86_64-linux-gnu/libdbus-1.so.3 /lib/x86_64-linux-gnu/libdl.so.2 /lib/x86_64-linux-gnu/libpthread.so.0 /lib/x86_64-linux-gnu/libm.so.6 /lib/x86_64-linux-gnu/librt.so.1 /lib/x86_64-linux-gnu/libc.so.6 /lib64/ld-linux-x86-64.so.2 /lib/x86_64-linux-gnu/libnss_compat.so.2 /lib/x86_64-linux-gnu/libnsl.so.1 /lib/x86_64-linux-gnu/libnss_nis.so.2 /lib/x86_64-linux-gnu/libnss_files.so.2  
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: Register dump [23]: 00000000000000bcfffffffff800bbd100007fe8c0003b30000000000000004000007fe8b8000b1000007fe8c0001810000000000000001200000000b800e37000007fe8c000a2b4000000000000000000007fe8c00019c000000000000000bc000000000000000000000000000000bc00007fe8c000a2b400007fe8a77fda70000000000049ddf0000000000001020200000000000000330000000000000004000000000000000efffffffe7ffbba030000000000000000
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: STACKTRACE
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: /src/tvheadend/src/trap.c:148 0x447089
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: ??:0 0x7fe91cff7340
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: /usr/include/x86_64-linux-gnu/bits/string3.h:51 0x49ddf0
Dec  5 21:54:11 satip-server-71 tvheadend[29349]: CRASH: /src/tvheadend/src/wrappers.c:177 0x416bbe
Dec  5 21:54:11 satip-server-71 kernel: [93071.761656] tvh:satip-rtp[31272]: segfault at 0 ip 000000000049ddf0 sp 00007fe8a77fda70 error 4 in tvheadend[400000+1a6000]
Dec  5 21:54:12 satip-server-71 kernel: [93072.183960] init: tvheadend main process (29349) killed by SEGV signal
Dec  5 21:54:12 satip-server-71 kernel: [93072.183984] init: tvheadend main process ended, respawning

when the SAT>IP client requests a encrypted channel, I can reproduce this segfault with the last 20+ git check outs of TVH, rewrite PMT is set.

I have done the tests with linux vdr + satip plugin, DVB Viever Lite, WatchTVPro, Panasonic SAT>IP TV and the Schwaiger DSR51 SAT>IP HDMI Stick, all
clients trigger the segfault in the same way.

The card server is OSCAM, tested with various revision between 11100 and latest, the local cards are - SKY UK, SRF, ORF, SKY DE and HD+ same behavior with each card,
and no difference with either DVB API or newcamd proto.

To be on the save side I did some tests with minisatip, this is working well in all combinations, so in my opinion I can exclude my clients and the cardserver set up.

You find attached the syslog and GDB logs.

Just let me know if you need more information.

Kind regards


Files

gdb.log (11.2 KB) gdb.log Tux Droid, 2015-12-06 00:56
syslog.log (16.1 KB) syslog.log Tux Droid, 2015-12-06 00:56

Associated revisions

Revision acf4b867 (diff)
Added by Jaroslav Kysela over 6 years ago

SAT>IP server: RTP - fix possible NULL dereference, fixes #3386

History

#1

Updated by Jaroslav Kysela over 6 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Also available in: Atom PDF