[mythtv] Ticket #1578: Mythfrontend segfault w/dvb radio PID type(private-sec 0x5), MHEG?

[Daniel Kristjansson]

On Wed, 2006-04-12 at 16:23 -0400, Mark Buechler wrote:
> Daniel, I don't wish to bug, but I was wondering if you had a few
> minutes to look at this one. I'm sure it's something simple but I
> don't know enough about TS packets to really know what I'm looking at.

Ok, so since we are in the "if (is_start)" portion handle_packet()
it looks like this is the first TS packet of a PES packet.

Then it looks like the length of the adaptation field is zero
since len == 0. This is the case for most PES packets.

Then it looks like we call write_section_data() with
a length of "p_end - p" which in this case is 183 bytes,
this again is normal.

So it looks like the problem is somewhere within the write_section_data
function.

Anyway, it looks like section_h_size is 37 when it crashed, which is
a bit on the short side, even for a PAT packet. Is this happening
on the first trip through the "while (1)" loop, or has some bad data
gotten in there (it looks like the first time, since section_index
hasn't been shrunk from the original 183). Was the CRC checked?
It looks like we keep trying to parse the packet even if the CRC
fails, which seems wrong to me; though in truth it shouldn't cause
a segfault since section_index always gets shrunk when we copy
the data.

I hope this helps, I recommend printing out the section_index
and section_h_size before you enter the loop, and then printing
the results of each step of the parsing in the loop. Then wait
for a segfault and then look at the last lines of the log.

-- Daniel