Bug #4119
Segfault: heap-use-after-free on channel_delete
Start date:
2016-12-06
Due date:
% Done:
100%
Estimated time:
Found in version:
git 48b9f49
Affected Versions:
Description
Message from clang:
================================================================= ==31450==AddressSanitizer: while reporting a bug found another one.Ignoring. ==31450==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160008bc5bc at pc 0x7f756328b828 bp 0x7f755b697ed0 sp 0x7f755b697ec8 WRITE of size 4 at 0x6160008bc5bc thread T9 (tvh:httpc) #0 0x7f756328b827 in http_client_reconnect /home/waldmeister/src/tvheadend/src/httpc.c:1462 #1 0x7f7563288afb in http_client_simple_reconnect /home/waldmeister/src/tvheadend/src/httpc.c:1266 #2 0x7f7563a40f33 in iptv_http_reconnect /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv_http.c:365 #3 0x7f7563a3d39d in iptv_http_complete /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv_http.c:440 #4 0x7f756329602f in http_client_finish /home/waldmeister/src/tvheadend/src/httpc.c:680 #5 0x7f756327ec72 in http_client_run0 /home/waldmeister/src/tvheadend/src/httpc.c:984 #6 0x7f756327c2c0 in http_client_run /home/waldmeister/src/tvheadend/src/httpc.c:1149 #7 0x7f7563291b87 in http_client_thread /home/waldmeister/src/tvheadend/src/httpc.c:1411 #8 0x7f7562f3c632 in thread_wrapper /home/waldmeister/src/tvheadend/src/wrappers.c:159 #9 0x7f7561280183 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8183) #10 0x7f755fa2337c (/lib/x86_64-linux-gnu/libc.so.6+0xfa37c) 0x6160008bc5bc is located 60 bytes inside of 544-byte region [0x6160008bc580,0x6160008bc7a0) freed by thread T21 (tvh:mtimer) here: #0 0x7f7562e6bfd9 in __interceptor_free (/home/waldmeister/src/tvheadend/build.linux/tvheadend+0x4dcfd9) #1 0x7f7563290184 in http_client_close /home/waldmeister/src/tvheadend/src/httpc.c:1622 #2 0x7f7563a36b8b in iptv_http_stop /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv_http.c:557 #3 0x7f7563a250fe in iptv_input_stop_mux /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv.c:379 #4 0x7f756376df2b in mpegts_mux_stop /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:840 #5 0x7f75636fd812 in mpegts_input_close_service /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_input.c:815 #6 0x7f75637976ae in mpegts_service_stop /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_service.c:410 #7 0x7f75630e0331 in service_stop /home/waldmeister/src/tvheadend/src/service.c:359 #8 0x7f75630bdf48 in subscription_unlink_service0 /home/waldmeister/src/tvheadend/src/subscriptions.c:166 #9 0x7f75630bd2bf in subscription_unlink_service /home/waldmeister/src/tvheadend/src/subscriptions.c:173 #10 0x7f75630e0d6f in service_remove_subscriber /home/waldmeister/src/tvheadend/src/service.c:401 #11 0x7f75630ca248 in subscription_unsubscribe /home/waldmeister/src/tvheadend/src/subscriptions.c:705 #12 0x7f7563782a69 in mpegts_mux_unsubscribe_by_name /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:1386 #13 0x7f7563834af8 in mpegts_network_scan_mux_done0 /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_network_scan.c:116 #14 0x7f7563836884 in mpegts_network_scan_mux_done /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_network_scan.c:159 #15 0x7f7563769594 in mpegts_mux_scan_done /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:1097 #16 0x7f756378eab5 in mpegts_mux_scan_timeout /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:1156 #17 0x7f7562e9e38e in mtimer_thread /home/waldmeister/src/tvheadend/src/main.c:634 #18 0x7f7562f3c632 in thread_wrapper /home/waldmeister/src/tvheadend/src/wrappers.c:159 #19 0x7f7561280183 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8183) previously allocated by thread T21 (tvh:mtimer) here: #0 0x7f7562e6c229 in calloc (/home/waldmeister/src/tvheadend/build.linux/tvheadend+0x4dd229) #1 0x7f756328e126 in http_client_connect /home/waldmeister/src/tvheadend/src/httpc.c:1528 #2 0x7f7563a36008 in iptv_http_start /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv_http.c:517 #3 0x7f7563a2490f in iptv_input_start_mux /home/waldmeister/src/tvheadend/src/input/mpegts/iptv/iptv.c:356 #4 0x7f756375ace7 in mpegts_mux_instance_start /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:260 #5 0x7f7563796dc3 in mpegts_service_start /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_service.c:381 #6 0x7f75630e92e9 in service_start /home/waldmeister/src/tvheadend/src/service.c:699 #7 0x7f75630ef83a in service_find_instance /home/waldmeister/src/tvheadend/src/service.c:867 #8 0x7f75630c17f7 in subscription_start_instance /home/waldmeister/src/tvheadend/src/subscriptions.c:309 #9 0x7f75630d03ed in subscription_create_from_channel_or_service /home/waldmeister/src/tvheadend/src/subscriptions.c:856 #10 0x7f75630d1a52 in subscription_create_from_mux /home/waldmeister/src/tvheadend/src/subscriptions.c:928 #11 0x7f75637822e0 in mpegts_mux_subscribe /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_mux.c:1367 #12 0x7f75638335f2 in mpegts_network_scan_timer_cb /home/waldmeister/src/tvheadend/src/input/mpegts/mpegts_network_scan.c:62 #13 0x7f7562e9e38e in mtimer_thread /home/waldmeister/src/tvheadend/src/main.c:634 #14 0x7f7562f3c632 in thread_wrapper /home/waldmeister/src/tvheadend/src/wrappers.c:159 #15 0x7f7561280183 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8183) Thread T9 (tvh:httpc) created by T0 here: #0 0x7f7562e5b612 in pthread_create (/home/waldmeister/src/tvheadend/build.linux/tvheadend+0x4cc612) #1 0x7f7562f3c04b in tvhthread_create /home/waldmeister/src/tvheadend/src/wrappers.c:177 #2 0x7f756329101e in http_client_init /home/waldmeister/src/tvheadend/src/httpc.c:1658 #3 0x7f7562e96d31 in main /home/waldmeister/src/tvheadend/src/main.c:1203 #4 0x7f755f94af44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44) Thread T21 (tvh:mtimer) created by T0 here: #0 0x7f7562e5b612 in pthread_create (/home/waldmeister/src/tvheadend/build.linux/tvheadend+0x4cc612) #1 0x7f7562f3c04b in tvhthread_create /home/waldmeister/src/tvheadend/src/wrappers.c:177 #2 0x7f7562e972dd in main /home/waldmeister/src/tvheadend/src/main.c:1285 #3 0x7f755f94af44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44) SUMMARY: AddressSanitizer: heap-use-after-free /home/waldmeister/src/tvheadend/src/httpc.c:1462 http_client_reconnect Shadow bytes around the buggy address: 0x0c2c8010f860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c8010f870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c8010f880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c8010f890: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c8010f8a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2c8010f8b0: fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa 0x0c2c8010f8c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c8010f8d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c8010f8e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c8010f8f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c8010f900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==31450==ABORTING
Last debug messages:
2016-12-06 15:21:17.283 [ INFO]:subscription: 0AB4: "scan" unsubscribing 2016-12-06 15:21:17.283 [ DEBUG]:mpegts: XXXXXXXX in IPTV - close PID tables subscription [0042/0x61900882c080] 2016-12-06 15:21:17.283 [ DEBUG]:mpegts: XXXXXXXX in IPTV - stopping mux 2016-12-06 15:21:17.284 [ DEBUG]:mpegts: XXXXXXXX in IPTV - close PID 0000 (0) [20/0x622000486100] 2016-12-06 15:21:17.284 [ DEBUG]:mpegts: XXXXXXXX in IPTV - close PID 0011 (17) [16/0x6220000f3100] 2016-12-06 15:21:17.284 [ DEBUG]:mpegts: XXXXXXXX in IPTV - close PID 0012 (18) [20/0x62200062a100] 2016-12-06 15:21:17.284 [ DEBUG]:epggrab: grab done for XXXXXXXX in IPTV (stolen) 2016-12-06 15:21:17.284 [ DEBUG]:mpegts: IPTV - removing mux XXXXXXXX in IPTV from scan queue 2016-12-06 15:21:17.284 [ DEBUG]:mpegts: XXXXXXXX in IPTV - add raw service 2016-12-06 15:21:17.285 [ DEBUG]:service: 1: XXXXXXXX.mkv in IPTV si 0x61000070b840 <unknown> weight 0 prio 11 error 0 2016-12-06 15:21:17.285 [ INFO]:mpegts: XXXXXXXX.mkv in IPTV - tuning on IPTV
Some IPTV providers list VOD videos in their channel list, maybe thats a problem. I already wrote a python script that ignore these video muxes, but these types of muxes are created if there a new VOD videos.
History
Updated by Jaroslav Kysela about 8 years ago
- Status changed from New to Fixed
- % Done changed from 0 to 100
Applied in changeset commit:tvheadend|aeceb4a30f6426dc05e2975a9de9094955069b1a.