Tvheadend

I do the following test:

1 Run oscam in another PC
2 Set up CA to oscam server

And the tvheadend is still crash.

(gdb) bt
#0 0x001cbe0c in dvbcsa_bs_stream_transpose_out ()
#1 0x001ca848 in dvbcsa_bs_stream_cipher_batch ()
#2 0x001c7aa4 in dvbcsa_bs_decrypt ()
#3 0x000bb124 in tvhcsa_des_flush (csa=csa@entry=0x155f2f0, s=s@entry=0x1543ae0) at src/descrambler/tvhcsa.c:53
#4 0x000bb214 in tvhcsa_des_descramble (csa=csa@entry=0x155f2f0, s=s@entry=0x1543ae0, tsb=0x16ac408 "G\001\365\247ȷHD\f", tsb@entry=0x64dc74 "",
tsb_len=tsb_len@entry=0) at src/descrambler/tvhcsa.c:152
#5 0x00085e5c in descrambler_descramble (t=t@entry=0x1543ae0, st=st@entry=0x1543d10, tsb=0x64dc74 "", tsb@entry=0x16ac408 "G\001\365\247ȷHD\f",
len=0, len@entry=188) at src/descrambler/descrambler.c:479
#6 0x0008c678 in ts_recv_packet1 (t=0x1543ae0, tsb=tsb@entry=0x16ac408 "G\001\365\247ȷHD\f", len=len@entry=188, pcrp=pcrp@entry=0x0, table=1)
at src/input/mpegts/tsdemux.c:188
#7 0x00089c14 in mpegts_input_process (mpkt=0x1520c58, mi=<optimized out> at src/input/mpegts/mpegts_input.c:1131
#8 mpegts_input_thread (p=0x203638) at src/input/mpegts/mpegts_input.c:1240
#9 0x00016ac0 in thread_wrapper (p=0x153caf8) at src/wrappers.c:145
#10 0xb6f71204 in __thread_entry (func=0x16a14 <thread_wrapper>, arg=0x153caf8, tls=0xb6628dd0) at bionic/libc/bionic/pthread_create.cpp:105
#11 0xb6f7139c in pthread_create (thread_out=0x1532c90, attr=<optimized out>, start_routine=0x16a14 <thread_wrapper>, arg=0x78)
at bionic/libc/bionic/pthread_create.cpp:224
#12 0x00000000 in ?? ()

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 18320]
mpegts_input_table_dispatch (mm=0x184b308, tsb=tsb@entry=0x185d028 "G", tsb_len=188) at src/input/mpegts/mpegts_input.c:938
938 if (mt->mt_destroyed || !mt->mt_subscribed || mt->mt_pid != pid)
(gdb) bt
#0 mpegts_input_table_dispatch (mm=0x184b308, tsb=tsb@entry=0x185d028 "G", tsb_len=188) at src/input/mpegts/mpegts_input.c:938
#1 0x00089e10 in mpegts_input_table_thread (aux=0x184dc08) at src/input/mpegts/mpegts_input.c:1286
#2 0x00016ac0 in thread_wrapper (p=0x1842fe8) at src/wrappers.c:145
#3 0xb6e82204 in __thread_entry (func=0x16a14 <thread_wrapper>, arg=0x1842fe8, tls=0xb6637dd0) at bionic/libc/bionic/pthread_create.cpp:105
#4 0xb6e8239c in pthread_create (thread_out=0x184dcc0, attr=<optimized out>, start_routine=0x16a14 <thread_wrapper>, arg=0x78)
at bionic/libc/bionic/pthread_create.cpp:224
#5 0x018c5da0 in ?? ()
Cannot access memory at address 0x0
#6 0x018c5da0 in ?? ()
Cannot access memory at address 0x0
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Here I think the mt is already freed. Gdb report

(gdb) p *mt
Cannot access memory at address 0x912c6d34
(gdb)

I think the last node is totally modified by some bad guys.

(gdb) dlist mm->mm_tables->lh_first
value is 0x1c8e4a0
value is 0x1c5c358
value is 0x1c5af40
value is 0x1c59b28
value is 0x1c58710
value is 0x1c572f8
value is 0x1c55ee0
value is 0x1c54ac8
value is 0x1c536b0
value is 0x1c52298
value is 0x1c50e80
value is 0x1c390c0
value is 0x1c37ca8
value is 0x1c36890
value is 0x1c3dac8
value is 0x1c74d18
value is 0x1c73900
value is 0x1c4f538
value is 0xd3376a84
Cannot access memory at address 0xd3376a84
(gdb) p (mpegts_psi_table_t *)0x1c4f538
$1 = (mpegts_psi_table_t *) 0x1c4f538
(gdb) p *(mpegts_psi_table_t *)0x1c4f538
$2 = {mt_link = {le_next = 0xd3376a84, le_prev = 0xeda62725}, mt_state = {first = 0x4312be7c, last = 0x79f67eb0, root = 0xaff8bfc7, entries = 7601000},
mt_name = 0x1c738d0 "descrambler", mt_opaque = 0x1c46e18, mt_table = 0 '\000', mt_mask = 0 '\000', mt_pid = 7500, mt_complete = 0, mt_incomplete = 0,
mt_finished = 0 '\000', mt_sect = {ps_cc = 1 '\001', ps_cco = 0 '\000', ps_offset = 80, ps_lock = 1,
ps_data = '\377' <repeats 80 times>, "\061~\000J\263W@\317Q\213V\264;\323c6\031\063Vf\330\034$", '\377' <repeats 80 times>, '\000' <repeats 4816 times>}, mt_err_log = {last = 0, count = 0}}
(gdb) p *(mpegts_psi_table_t *)0x1c73900
$3 = {mt_link = {le_next = 0x1c4f538, le_prev = 0x1c74d18}, mt_state = {first = 0x0, last = 0x0, root = 0x0, entries = 0},
mt_name = 0x1bfd758 "descrambler", mt_opaque = 0x1ccf610, mt_table = 0 '\000', mt_mask = 0 '\000', mt_pid = 7504, mt_complete = 0, mt_incomplete = 0,
mt_finished = 0 '\000', mt_sect = {ps_cc = 8 '\b', ps_cco = 0 '\000', ps_offset = 80, ps_lock = 1,
ps_data = '\377' <repeats 80 times>, "XH\236܁7\206\320\r\244Z\245\226\246\372E(\256\v\000\272\316>", '\377' <repeats 80 times>, '\000' <repeats 4816 times>}, mt_err_log = {last = 0, count = 0}}
(gdb)

You may want to open a bug report for this & you could have used the following in gdb & uploaded the log instead of posting it in parts.

set logging on <filenamehere.log>

HTH.