Bug #4457: Segmentation Fault on long URL inside M3U file - strlen() function at src/url.c:112 - Tvheadend

Bug #4457

Segmentation Fault on long URL inside M3U file - strlen() function at src/url.c:112

Added by Raphael Lacerda over 7 years ago. Updated over 7 years ago.

Status:

Fixed

Priority:

Normal

Assignee:

Category:

IPTV

Target version:

Start date:

2017-06-24

Due date:

% Done:

100%

Estimated time:

Found in version:

tvheadend: version 4.2.2-63~g0cbd8a1

Affected Versions:

Description

Hello!

TVHeadend 4.2.2-63~g0cbd8a1 (debian package still found in DEB repositories) crashed every time I tried to use a specific M3U8 list within an IPTV Automatic Network.
At debug and core-dump analysis, I suspected that a specific item in the M3U8 list was problematic. This was confirmed after removing half of the list recursively, until the issued entry was left alone.

The issued entry happens to be a M3U8 file that contains very long URLs. Those URLs are probably mishandled by "strlen()" function inside src/url.c source code, as indicated by the full backtrace of the core dump.

Issued M3U8 playlist
http://listaiptvbrasil.com/tt.txt

attention: the first tag of the list (#EXTM3U) was preceded by a space character, avoiding TVHeadend to recognize the list formatting. Looks like the owner fixed the playlist already.

Issued M3U8 playlist segment

#EXTINF:-1 tvg-logo="https://lut.im/ogVGfv4QCU/HoTyEvQGcwNSJ3eG.png" group-title="FILMES", MaxUp
http://duost.ddns.me:19790/live/DSK94cdypL/nnnrhnV1Nv/86.m3u8

Issued M3U File Content: 86.m3u8

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-MEDIA-SEQUENCE:3592
#EXT-X-ALLOW-CACHE:YES
#EXT-X-TARGETDURATION:12
#EXTINF:8.000000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/134b9abb431c8500519aa2bece41c061/86_3592.ts
#EXTINF:11.999000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/82a28777ec9ad2b64f754ec9ee18c096/86_3593.ts
#EXTINF:8.000000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/63ff12aac7f66b078af815b134d679e2/86_3594.ts
#EXTINF:12.000000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/82696359a7ed607604768be5fffb96c5/86_3595.ts
#EXTINF:8.000000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/3eb1faafc2aad553f491959b3ec1e86c/86_3596.ts
#EXTINF:11.999000,
/hlsr/ShpaUURdE1sSUlYBVFYFBlsPDVRSCQMEB1dWCVJRAlRXDwEDUlEJAFIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBsB19TUFxcEF0KUVBbXVVEFX0VVFVBSRMEW0EQV01UEgJACg4LER1HUAxHX0xASRUPEyNiFk9HVB5GUAxFUF5eGlgRWwBGCUcfQVtCZ0BVREFDBFFZBhcTXBAFQBobXFFAPVBZXV1UBkcKXV9LEAoVBAFRABZPR1wJXFwWWUtuQFEGEQwRAQNQAVIQTA==/DSK94cdypL/nnnrhnV1Nv/86/16ec623a5763f13089857994dd1dba37/86_3597.ts

Debug Output (last 7 rows)

2017-06-24 05:40:21.387 [  DEBUG] mpegts: tvfoco.m3u - MaxUp in TV Foco Local - add raw service
2017-06-24 05:40:21.387 [  DEBUG] service: 1: tvfoco.m3u - MaxUp in TV Foco Local si 0x72b00bb8 <unknown> weight 0 prio 11 error 0
2017-06-24 05:40:21.387 [   INFO] mpegts: tvfoco.m3u - MaxUp in TV Foco Local - tuning on IPTV
2017-06-24 05:40:21.391 [  DEBUG] mpegts: tvfoco.m3u - MaxUp in TV Foco Local - started
2017-06-24 05:40:21.392 [  DEBUG] mpegts: tvfoco.m3u - MaxUp in TV Foco Local - open PID tables subscription [0042/0x72b10a78]
2017-06-24 05:40:21.392 [   INFO] subscription: 0002: "scan" subscribing to mux "tvfoco.m3u - MaxUp", weight: 5, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription" 
Segmentation fault (core dumped)

GDB Core Analysis

GNU gdb (Raspbian 7.7.1+dfsg-5+rpi1) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying" 
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from tvheadend...Reading symbols from /usr/lib/debug//usr/bin/tvheadend...done.
done.
[New LWP 17187]
…similar lines removed by Raphael…
[New LWP 17216]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
Core was generated by `tvheadend -d -D'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  strlen () at ../ports/sysdeps/arm/armv6/strlen.S:26
26    ../ports/sysdeps/arm/armv6/strlen.S: No such file or directory.

GDB Full Backtrace

(gdb) bt full
#0  strlen () at ../ports/sysdeps/arm/armv6/strlen.S:26
No locals.
#1  0x54b682ac in urlparse (str=<optimized out>, url=0x74ede944) at src/url.c:112
        state = {uri = 0x74ede7bc, errorCode = 0, errorPos = 0x0, reserved = 0x0}
        path = 0x73e019c0
        uri = {scheme = {first = 0x73e029f8 "http://107.182.226.91:19790/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQB"..., afterLast = 0x73e029fc "://107.182.226.91:19790/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlx"...}, userInfo = {first = 0x0, afterLast = 0x0}, hostText = {first = 0x73e029ff "107.182.226.91:19790/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGg"..., afterLast = 0x73e02a0d ":19790/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cL"...}, hostData = {ip4 = 0x73e07540, ip6 = 0x0, ipFuture = {first = 0x0, afterLast = 0x0}}, portText = {first = 0x73e02a0e "19790/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLR"..., afterLast = 0x73e02a13 "/hlsr/ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFl"...}, pathHead = 0x73e07388, pathTail = 0x73e01f78, query = {first = 0x0, afterLast = 0x0}, fragment = {first = 0x0, afterLast = 0x0}, absolutePath = 0, owner = 0, reserved = 0x0}
        s = <optimized out>
        buf = "ShpaUURdE1sSBgVdBAQCBgMCAQlSCFNRA1FQAlFXUAMGAQFRVAIBAAIWT0dCEkBQA1tmWFQaWAsAHxFEFlYRbVhcEAoVAQRDHBYXDFwDEA9SGhtBWVxACRQCBQFVBEEeE11KRFJHXwBcawcARw9RUEAMV0RcVE4RWV1sVQBeAlxVGggSBxcdQ1lHE0cLRHxQFlNVXRBs"...
#2  0x66635542 in ?? ()
No symbol table info available.
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

History

Updated by Raphael Lacerda over 7 years ago

In order to properly reproduce the issue, the option "Idle scan muxes" must be enabled.

Updated by Jaroslav Kysela over 7 years ago

Status changed from New to Fixed
% Done changed from 0 to 100

Applied in changeset commit:tvheadend|4bd91f85d5a56dc8e24e287766d1d6cf806e1ea5.

Updated by Raphael Lacerda over 7 years ago

Jaroslav Kysela wrote:

Applied in changeset commit:tvheadend|4bd91f85d5a56dc8e24e287766d1d6cf806e1ea5.

Looks like the build for this changeset failed, so I'm not able to confirm it's been fixed.
https://doozer.io/tvheadend/tvheadend/builds/4bd91f85d5a56dc8e24e287766d1d6cf806e1ea5

Thanks!

Updated by Jaroslav Kysela over 7 years ago

Use the next build. The fix is there.

Updated by Raphael Lacerda over 7 years ago

I'll wait for it. Thank you!

Updated by Raphael Lacerda over 7 years ago

Hello, I complied a newer version from the git repository (4.3-285~g09a52c3), and it worked!
Yet, I noticed that the issued .m3u segment that contained the .m3u8 file with long URLs inside was completely ignored by the scan operation.

To push the test forward, I manually added this issued segment to the list of muxes, naming it "MaxUp", and set its "Scan Status" to "ACTIVE".
After that, I forced a "Map all services" under the "Services" tab and, when it reached the entry I manually added, Tvheadend crashed again.
Unfortunately, it looks like long URLs are still a problem for Tvheadend. I'm posting details below, but if you think a new bug should be open, just let me know.

Issued .m3u segment (the same as in the original bug)

http://duost.ddns.me:19790/live/DSK94cdypL/nnnrhnV1Nv/86.m3u8

Latest lines from debug output

2017-07-02 17:50:46.450 [  DEBUG] mpegts: adding mux Multiplex [onid:FFFF tsid:FFFF] in TV Foco Local to scan queue weight 5 flags 1000
2017-07-02 17:50:49.360 [  DEBUG] settings: saving to /home/pi/tvheadend/build.linux/test-conf/input/iptv/networks/1324d5a1e9af8536b28f2dd8450ddfa0/muxes/f594b00cf025b532d8999d86084822f4
2017-07-02 17:50:56.360 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:50:56.360 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x569aafb8 <unknown> weight 0 prio 11 error 0
2017-07-02 17:50:56.360 [   INFO] mpegts: MaxUp in TV Foco Local - tuning on IPTV
2017-07-02 17:50:56.514 [  DEBUG] mpegts: MaxUp in TV Foco Local - started
2017-07-02 17:50:56.515 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID tables subscription [0042/0x56a66868]
2017-07-02 17:50:56.515 [   INFO] subscription: 00B8: "scan" subscribing to mux "MaxUp", weight: 5, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription" 
2017-07-02 17:50:58.470 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] 
2017-07-02 17:51:14.910 [   INFO] http: 192.168.0.3: using ticket E10CB3365C449C1C02DF2F26E7195C27C56601CE for /stream/mux/f594b00cf025b532d8999d86084822f4
2017-07-02 17:51:14.913 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:51:14.914 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x56a7ff08 <unknown> weight -1 prio 9 error 0
2017-07-02 17:51:14.914 [  DEBUG] mpegts: MaxUp in TV Foco Local - already active
2017-07-02 17:51:14.914 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID fullmux subscription [0003/0x72a01720]
2017-07-02 17:51:14.915 [   INFO] subscription: 00B9: "HTTP" subscribing to mux "MaxUp", weight: 10, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription", hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:51:16.914 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] 
2017-07-02 17:51:26.470 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] [Graceperiod expired] [Data timeout] 
2017-07-02 17:51:26.470 [   INFO] mpegts: MaxUp in TV Foco Local - scan no data, failed
2017-07-02 17:51:26.470 [   INFO] subscription: 00B8: "scan" unsubscribing
2017-07-02 17:51:26.470 [  DEBUG] mpegts: MaxUp in TV Foco Local - close PID tables subscription [0042/0x56a66868]
2017-07-02 17:51:26.471 [  DEBUG] mpegts: removing mux MaxUp in TV Foco Local from scan queue
2017-07-02 17:51:29.471 [  DEBUG] settings: saving to /home/pi/tvheadend/build.linux/test-conf/input/iptv/networks/1324d5a1e9af8536b28f2dd8450ddfa0/muxes/f594b00cf025b532d8999d86084822f4
2017-07-02 17:51:35.104 [WARNING] webui: Stop streaming /stream/mux/f594b00cf025b532d8999d86084822f4?ticket=E10CB3365C449C1C02DF2F26E7195C27C56601CE, timeout waiting for packets
2017-07-02 17:51:35.105 [   INFO] subscription: 00B9: "HTTP" unsubscribing, hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:51:35.105 [  DEBUG] mpegts: MaxUp in TV Foco Local - close PID fullmux subscription [0003/0x72a01720]
2017-07-02 17:51:35.105 [  DEBUG] mpegts: MaxUp in TV Foco Local - stopping mux
2017-07-02 17:51:35.134 [   INFO] http: 192.168.0.3: using ticket E10CB3365C449C1C02DF2F26E7195C27C56601CE for /stream/mux/f594b00cf025b532d8999d86084822f4
2017-07-02 17:51:35.135 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:51:35.135 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x56a1f238 <unknown> weight 0 prio 11 error 0
2017-07-02 17:51:35.135 [   INFO] mpegts: MaxUp in TV Foco Local - tuning on IPTV
2017-07-02 17:51:35.141 [  DEBUG] mpegts: MaxUp in TV Foco Local - started
2017-07-02 17:51:35.141 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID fullmux subscription [0003/0x72a00e20]
2017-07-02 17:51:35.141 [   INFO] subscription: 00BA: "HTTP" subscribing to mux "MaxUp", weight: 10, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription", hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:51:37.135 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] 
2017-07-02 17:51:40.135 [  DEBUG] webui: Stop streaming /stream/mux/f594b00cf025b532d8999d86084822f4?ticket=E10CB3365C449C1C02DF2F26E7195C27C56601CE, client hung up
2017-07-02 17:51:40.136 [   INFO] subscription: 00BA: "HTTP" unsubscribing, hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:51:40.136 [  DEBUG] mpegts: MaxUp in TV Foco Local - close PID fullmux subscription [0003/0x72a00e20]
2017-07-02 17:51:40.136 [  DEBUG] mpegts: MaxUp in TV Foco Local - stopping mux
2017-07-02 17:52:57.300 [  DEBUG] mpegts: adding mux MaxUp in TV Foco Local to scan queue weight 6 flags 4000
2017-07-02 17:52:57.301 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:52:57.301 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x56a6c758 <unknown> weight 0 prio 11 error 0
2017-07-02 17:52:57.301 [   INFO] mpegts: MaxUp in TV Foco Local - tuning on IPTV
2017-07-02 17:52:57.308 [  DEBUG] mpegts: MaxUp in TV Foco Local - started
2017-07-02 17:52:57.308 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID tables subscription [0042/0x56a66868]
2017-07-02 17:52:57.308 [   INFO] subscription: 00BB: "scan" subscribing to mux "MaxUp", weight: 6, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription" 
2017-07-02 17:52:59.301 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] 
2017-07-02 17:53:00.276 [  DEBUG] settings: saving to /home/pi/tvheadend/build.linux/test-conf/input/iptv/networks/1324d5a1e9af8536b28f2dd8450ddfa0/muxes/f594b00cf025b532d8999d86084822f4
2017-07-02 17:53:12.354 [   INFO] http: 192.168.0.3: using ticket F88A7F3CE658B7F8F38784B605C41D18BDC267E6 for /stream/mux/f594b00cf025b532d8999d86084822f4
2017-07-02 17:53:12.356 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:53:12.357 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x56a3c800 <unknown> weight -1 prio 9 error 0
2017-07-02 17:53:12.357 [  DEBUG] mpegts: MaxUp in TV Foco Local - already active
2017-07-02 17:53:12.357 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID fullmux subscription [0003/0x72a03588]
2017-07-02 17:53:12.358 [   INFO] subscription: 00BC: "HTTP" subscribing to mux "MaxUp", weight: 10, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription", hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:53:13.189 [  DEBUG] settings: saving to /home/pi/tvheadend/build.linux/test-conf/service_mapper/config
2017-07-02 17:53:14.357 [  DEBUG] service: MaxUp in TV Foco Local: Status changed to [CA check] 
2017-07-02 17:53:16.192 [  DEBUG] webui: Stop streaming /stream/mux/f594b00cf025b532d8999d86084822f4?ticket=F88A7F3CE658B7F8F38784B605C41D18BDC267E6, client hung up
2017-07-02 17:53:16.192 [   INFO] subscription: 00BC: "HTTP" unsubscribing, hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)" 
2017-07-02 17:53:16.192 [  DEBUG] mpegts: MaxUp in TV Foco Local - close PID fullmux subscription [0003/0x72a03588]
2017-07-02 17:53:16.767 [   INFO] http: 192.168.0.3: using ticket F88A7F3CE658B7F8F38784B605C41D18BDC267E6 for /stream/mux/f594b00cf025b532d8999d86084822f4
2017-07-02 17:53:16.767 [  DEBUG] mpegts: MaxUp in TV Foco Local - add raw service
2017-07-02 17:53:16.768 [  DEBUG] service: 1: MaxUp in TV Foco Local si 0x56a718e0 <unknown> weight -1 prio 9 error 0
2017-07-02 17:53:16.768 [  DEBUG] mpegts: MaxUp in TV Foco Local - already active
2017-07-02 17:53:16.768 [  DEBUG] mpegts: MaxUp in TV Foco Local - open PID fullmux subscription [0003/0x72a03588]
2017-07-02 17:53:16.768 [   INFO] subscription: 00BD: "HTTP" subscribing to mux "MaxUp", weight: 10, adapter: "IPTV", network: "TV Foco Local", service: "Raw PID Subscription", hostname="192.168.0.3", client="AppleCoreMedia/1.0.0.15G1421 (Macintosh; U; Intel Mac OS X 10_11_6; pt_br)"

Core Dump Debug with GDB

pi@RaspberryPi2:~/tvheadend/build.linux $ gdb ./tvheadend core 
GNU gdb (Raspbian 7.7.1+dfsg-5+rpi1) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying" 
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./tvheadend...done.
[New LWP 32157]
[New LWP 32061]
[New LWP 32072]
[New LWP 32064]
[New LWP 32062]
[New LWP 32099]
[New LWP 32067]
[New LWP 32090]
[New LWP 32092]
[New LWP 32102]
[New LWP 32068]
[New LWP 32098]
[New LWP 32069]
[New LWP 32101]
[New LWP 32078]
[New LWP 32071]
[New LWP 32091]
[New LWP 32076]
[New LWP 32074]
[New LWP 32158]
[New LWP 32066]
[New LWP 32173]
[New LWP 32077]
[New LWP 32063]
[New LWP 32094]
[New LWP 32088]
[New LWP 32065]
[New LWP 32075]
[New LWP 32070]
[New LWP 32073]
[New LWP 32175]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
Core was generated by `./tvheadend -c test-conf -d'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  htsmsg_field_destroy (msg=msg@entry=0x569dd570, f=0x58a1cf38) at src/htsmsg.c:85
85      TAILQ_REMOVE(&msg->hm_fields, f, hmf_link);
(gdb) set logging on
Copying output to gdb.txt.
(gdb) set pagination off
(gdb) bt full
#0  htsmsg_field_destroy (msg=msg@entry=0x569dd570, f=0x58a1cf38) at src/htsmsg.c:85
No locals.
#1  0x54c0ec24 in htsmsg_clear (msg=0x569dd570) at src/htsmsg.c:111
        f = <optimized out>
#2  htsmsg_field_data_destroy (f=f@entry=0x569dd560) at src/htsmsg.c:49
No locals.
#3  0x54c0eb94 in htsmsg_field_destroy (msg=msg@entry=0x75701258, f=0x569dd560) at src/htsmsg.c:87
No locals.
#4  0x54c0ec24 in htsmsg_clear (msg=0x75701258) at src/htsmsg.c:111
        f = <optimized out>
#5  htsmsg_field_data_destroy (f=f@entry=0x75701248) at src/htsmsg.c:49
No locals.
#6  0x54c0eb94 in htsmsg_field_destroy (msg=msg@entry=0x757011d0, f=0x75701248) at src/htsmsg.c:87
No locals.
#7  0x54c0ef48 in htsmsg_clear (msg=<optimized out>) at src/htsmsg.c:111
        f = <optimized out>
#8  htsmsg_destroy (msg=msg@entry=0x757011d0) at src/htsmsg.c:289
No locals.
#9  0x54c67734 in comet_mailbox_poll (hc=0x71afe9d0, remain=<optimized out>, opaque=<optimized out>) at src/webui/comet.c:305
        cmb = 0x757007d8
        cometid = <optimized out>
        immediate = <optimized out>
        lang = <optimized out>
        im = <optimized out>
        e = <optimized out>
        mono = <optimized out>
        m = 0x757011d0
#10 0x54be6954 in http_exec (hc=hc@entry=0x71afe9d0, hp=hp@entry=0x71afe7c4, remain=0x0) at src/http.c:936
        err = <optimized out>
#11 0x54be76f4 in http_cmd_post (spill=<optimized out>, hc=0x71afe9d0) at src/http.c:1073
        hp = {hp_link = {le_next = 0x569a69b0, le_prev = 0x5699b080}, hp_path = 0x56b7b1a0 "/comet/poll", hp_opaque = 0x0, hp_callback = 0x54c6759c <comet_mailbox_poll>, hp_len = 11, hp_no_verification = 0, hp_accessmask = 8, hp_path_modify = 0x0}
        remain = 0x0
        args = 0x0
        v = <optimized out>
#12 http_process_request (hc=0x71afe9d0, spill=<optimized out>) at src/http.c:1095
No locals.
#13 0x54be6e68 in process_request (hc=hc@entry=0x71afe9d0, spill=spill@entry=0x71afe998) at src/http.c:1213
        v = <optimized out>
        argv = {0x0, 0x0}
        n = <optimized out>
        rval = -1
        authbuf = "192.168.0.3\000\300'pu\r\003\000\000\000\360\253v\002\000\000\000\000\360\253v\002", '\000' <repeats 19 times>, " \000\000\000\000\000\000\000\070\000\000\000[\000\000\000n\000\000\000w\000\000\000|\000\000\000(\362\253v\264\033\252v(\362\253v\020\000pub\030\000\000\020\000pu", '\000' <repeats 16 times>, "\340\006puDT\301T\020\000pu\340\006pu\001\000\000\000\230\351\257q\340\006pu\337\006" 
#14 0x54be7ab4 in http_serve_requests (hc=hc@entry=0x71afe9d0) at src/http.c:1508
        spill = {hq_q = {tqh_first = 0x0, tqh_last = 0x71afe998}, hq_size = 0, hq_maxsize = 2147483647}
        argv = {0x75702bf0 "p\003pup\003pu\350+pu\350+puhannel=o%3Acolumns%3Da%253Ao%25253Aid%25253Dn%2525253A0%25255Ewidth%25253Dn%2525253A25%255Eo%25253Aid%25253Dn%2525253A1%25255Ewidth%25253Dn%2525253A25%255Eo%25253Aid%25253Dn%2525253A2%"..., 0x75702bf8 "\350+pu\350+puhannel=o%3Acolumns%3Da%253Ao%25253Aid%25253Dn%2525253A0%25255Ewidth%25253Dn%2525253A25%255Eo%25253Aid%25253Dn%2525253A1%25255Ewidth%25253Dn%2525253A25%255Eo%25253Aid%25253Dn%2525253A2%25255Ewi"..., 0x75700d79 "HTTP/1.1"}
        c = <optimized out>
        s = <optimized out>
        cmdline = 0x75700d68 "POST" 
        hdrline = 0x757006e0 "" 
        n = <optimized out>
        r = <optimized out>
        delim = <optimized out>
#15 0x54be7cb8 in http_serve (fd=27, opaque=0x72106540, peer=0x7210654c, self=0x721065cc) at src/http.c:1555
        hc = {hc_fd_lock = {__data = {__lock = 0, __count = 0, __owner = 0, __kind = 0, __nusers = 0, {__spins = 0, __list = {__next = 0x0}}}, __size = '\000' <repeats 23 times>, __align = 0}, hc_fd = 27, hc_peer = 0x7210654c, hc_peer_ipstr = 0x71afe808 "192.168.0.3", hc_self = 0x721065cc, hc_representative = 0x71afe808 "192.168.0.3", hc_paths_mutex = 0x54e46dc0 <http_paths_mutex>, hc_paths = 0x54e46dd8 <http_paths>, hc_process = 0x54be7530 <http_process_request>, hc_url = 0x75700d6d "/comet/poll", hc_url_orig = 0x71afe820 "/comet/poll", hc_keep_alive = 1, hc_reply = {hq_q = {tqh_first = 0x75700988, tqh_last = 0x75701e50}, hq_size = 3779, hq_maxsize = 2147483647}, hc_args = {tqh_first = 0x75700468, tqh_last = 0x757009b8}, hc_req_args = {tqh_first = 0x75700768, tqh_last = 0x75700a20}, hc_state = HTTP_CON_WAIT_REQUEST, hc_cmd = HTTP_CMD_POST, hc_version = HTTP_VERSION_1_1, hc_username = 0x0, hc_password = 0x0, hc_authhdr = 0x0, hc_nonce = 0x0, hc_access = 0x75700a58, hc_user_config = 0x0, hc_no_output = 0, hc_shutdown = 0, hc_cseq = 0, hc_session = 0x0, hc_post_data = 0x75700870 "boxid", hc_post_len = 58}
#16 0x54be0328 in tcp_server_start (aux=0x72106528) at src/tcp.c:651
        tsl = 0x72106528
        to = {tv_sec = 30, tv_usec = 0}
        val = 1
        c = 74 'J'
#17 0x54bdbcbc in thread_wrapper (p=0x72100e50) at src/wrappers.c:161
        ts = 0x72100e50
        set = {__val = {16388, 0 <repeats 31 times>}}
        r = <optimized out>
#18 0x76b5ce90 in start_thread (arg=0x71aff170) at pthread_create.c:311
        pd = 0x71aff170
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {1907356120, 0, 1939860012, 338, 1913677096, 1939863088, 0, 1907354796, 1058252144, 940146784, 0 <repeats 54 times>}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = 0
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
        __PRETTY_FUNCTION__ = "start_thread" 
#19 0x76a53598 in ?? () at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:92 from /lib/arm-linux-gnueabihf/libc.so.6
No locals.
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

Thanks and regards!

Updated by Jaroslav Kysela over 7 years ago

https://tvheadend.org/projects/tvheadend/wiki/Debugging#Memory-leaks-or-corruption , I don't see the issue from the backtrace .

Updated by Raphael Lacerda over 7 years ago

I tried to reproduce this previous backtrace I posted, but it didn't happen again.
Sorry, I might have done something wrong that ended up crashing Tvheadend.

It is working now even if I add the issued .m3u URL manually to the muxes list. The problem it does not become a service may be that the stream is no longer working. Either way, the "Map all services" function didn't crash as before.

Looks like everything is perfect.

Thank you!

Also available in: Atom PDF

Project

General

Profile

Tvheadend

Issues

Custom queries

Bug #4457

Segmentation Fault on long URL inside M3U file - strlen() function at src/url.c:112

History

Updated by Raphael Lacerda over 7 years ago

Updated by Jaroslav Kysela over 7 years ago

Updated by Raphael Lacerda over 7 years ago

Updated by Jaroslav Kysela over 7 years ago

Updated by Raphael Lacerda over 7 years ago

Updated by Raphael Lacerda over 7 years ago

Updated by Jaroslav Kysela over 7 years ago

Updated by Raphael Lacerda over 7 years ago