October 2013 - DVDnav-discuss - lists.mplayerhq.hu

[patch] Fix SIGSEGV in dvdnav_describe_title_chapters
by Sylvain HENRY 05 Oct '13

05 Oct '13

Hi, Please consider checking and applying the attached patch. It fixes a segfault occuring with some DVDs. It seems to be the same problem as the one mentionned here: https://bugs.launchpad.net/ubuntu/+source/libdvdnav/+bug/934471 In my case, "cellnr" and "endcellnr" variables were set to 0 when the crash occured. Cheers Sylvain PS: I'm not registered on the mailing-list, please answer directly to me if necessary

3 8

[propchange]: r1262 - svn:log
by rathann 05 Oct '13

05 Oct '13

Author: rathann Revision: 1262 Property Name: svn:log Action: modified Property diff: --- old property value +++ new property value @@ -1,4 +1,7 @@ Let dvdnav_describe_title_chapters() skip PGCs with a cell number of zero. +In this case pgc->program_map can be invalid and +accessing it results in a core dump due to SIGBUS. + Patch by Fabian Keil $fk%fabiankeil^de&

1 0

[propchange]: r1261 - svn:log
by rathann 05 Oct '13

05 Oct '13

Author: rathann Revision: 1261 Property Name: svn:log Action: modified Property diff: --- old property value +++ new property value @@ -1,6 +1,9 @@ +Let dvdnav_describe_title_chapters() ignore parts where + the pgc_start_byte is above the last_byte + This is a heuristic to prevent segfaults when - ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc is invalid - but non-NULL. +ifo->vts_pgcit->pgci_srp[ptt[i].pgcn-1].pgc is invalid +but non-NULL. Patch by Fabian Keil #fk$fabiankeil%de^

1 0

Re: [DVDnav-discuss] Error in libdvdnav when reading iso images
by Fabian Keil 05 Oct '13

05 Oct '13

Oncaphillis wrote in http://lists.mplayerhq.hu/pipermail/dvdnav-discuss/2012-May/001722.html: > I used to create DVD iso images via k3b and played them via VLC. > With isos of relatively newly released DVD this stops to work and > VLC fails with the message > > libdvdnav: demux error! 00 00 00 (should be 0x000001) > > Playing directly from /dev/dvd still works > > The distro is Fedora16 > + k3b == 2.0.2 > + libdvdcss == 1.2.11 ( I also tested 1.2.12) > + vlc = 1.1.13 > + libdvdnav 4.1.4. I also tried the current SVN build > > I get the same error when playing with mplayer and > I also tried brasero for iso creation. > > Since direct play works it seems like brasero/k3b have > problems to create a proper iso and the problems sits > somewhere in the libs. The above message can be generated when the ripping program has generously padded regions with unreadable sectors with binary zeros and one of the padded blocks is actually referenced in the ifos. In this case it's not the result of a bug in the libs (assuming you meant libdvdnav or libdvdread) but the result of a limitation in the program that is using them in combination with companies that interpret the relevant standards somewhat liberal. I'm not familiar with k3b or brasero and thus don't know if this is the cause of the issue, but at least it would explain why the real disc works and the copy doesn't. I've never seen the issue with discs that haven't obviously been mastered incorrectly, but I suppose it can also happen if the disc is scratched. In my experience, copies of intentionally incorrectly mastered discs that cause this issue when padding with zeroes, can usually be played correctly with VLC when padding with other blocks from the region that have been read correctly instead. It's not perfect, but can be sufficient to solve the issue. I'm still experimenting with this, though. With some of those copies I can trigger at least four different crashes in libdvdnav 4.2.0's dvdnav_describe_title_chapters(), that aren't triggered when ripping with zero padding which lets VLC rejects the disc right away. Recent VLC versions use this function, but one can work around it by undefining HAVE_DVDNAV_DESCRIBE_TITLE_CHAPTERS. VLC 1.1.3 doesn't seem to use the function yet and thus correctly plays the copies out of the box (I only confirmed the latter). One of these issues has already been fixed after the libdvdnav 4.2.0 release (https://bugs.launchpad.net/ubuntu/+source/libdvdnav/+bug/934471) but as far as I can tell the others still exist, or at least don't seem to be fixed in https://github.com/microe/libdvdnav and I haven't seen them mentioned when crawling the archives either. I attached the patches that seem to prevent these crashes for me. I'd appreciate comments on whether or not the skip conditions are reasonable, especially the one in patch 3. Note that I ran into the issues with copies where I now know that the padding has been done somewhat sloppy. I haven't tested yet if these crashes can be reached by playing the original discs. If not, I suspect that with a fancier padding algorithms the copies might play correctly as well. Fabian

4 4

[PATCH] Sanitize PTT start offsets
by John Stebbins 05 Oct '13

05 Oct '13

If the start offset points past the last_byte (outside the region read) stop reading PTTs and adjust nr_of_srpts. Fixes Transformers 3 -- John GnuPG fingerprint: D0EC B3DB C372 D1F1 0B01 83F0 49F1 D7B2 60D4 D0F7

3 5

r1266 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 01:15:54 2013 New Revision: 1266 Log: Let dvdnav_describe_title_chapters() skip PGCs with missing cells. Fixes segfaults with a rip of Ghost Protocol. Patch by Fabian Keil #fk$fabiankeil%de^ Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Fri Oct 4 01:02:55 2013 (r1265) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 01:15:54 2013 (r1266) @@ -642,6 +642,10 @@ uint32_t dvdnav_describe_title_chapters( printerr("Cell new row cannot be 0"); continue; } + if (pgc->cell_playback == NULL) { + printerr("Cell missing"); + continue; + } if(ptt[i].pgn < pgc->nr_of_programs) endcellnr = pgc->program_map[ptt[i].pgn];

1 0

r1265 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 01:02:55 2013 New Revision: 1265 Log: Make sure program_map is not NULL. pgc->program_map should be checked before dereferencing. On the DVD "Jack Reacher" this was discovered as a problem. Bug discovery and suggested fix given by Cathy McDonald. Thanks! Patch by Erik Hovland !erik#hovland$org% Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Fri Oct 4 00:43:52 2013 (r1264) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 01:02:55 2013 (r1265) @@ -625,6 +625,10 @@ uint32_t dvdnav_describe_title_chapters( printerr("PGC missing."); continue; } + if (pgc->program_map == NULL) { + printerr("Program map missing."); + continue; + } if(ptt[i].pgn > pgc->nr_of_programs) { printerr("WRONG part number."); goto fail;

1 0

r1264 - trunk/libdvdnav/src/vm/vm.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:43:52 2013 New Revision: 1264 Log: Do not close file twice. There is another close further down that will always be reached. Patch by Reimar Döffinger ^Reimar&Doeffinger*gmx!de# Modified: trunk/libdvdnav/src/vm/vm.c Modified: trunk/libdvdnav/src/vm/vm.c ============================================================================== --- trunk/libdvdnav/src/vm/vm.c Fri Oct 4 00:39:38 2013 (r1263) +++ trunk/libdvdnav/src/vm/vm.c Fri Oct 4 00:43:52 2013 (r1264) @@ -176,7 +176,6 @@ static void dvd_read_name(char *name, ch off = lseek( fd, 32 * (off_t) DVD_VIDEO_LB_LEN, SEEK_SET ); if( off == ( 32 * (off_t) DVD_VIDEO_LB_LEN ) ) { off = read( fd, data, DVD_VIDEO_LB_LEN ); - close(fd); if (off == ( (off_t) DVD_VIDEO_LB_LEN )) { fprintf(MSG_OUT, "libdvdnav: DVD Title: "); for(i=25; i < 73; i++ ) {

1 0

r1263 - trunk/libdvdnav/src/dvdnav.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:39:38 2013 New Revision: 1263 Log: Fix integer overflow in dvdnav_convert_time(). Currently the calculation will use int and thus overflow for anything larger or equal to 20 hours. Patch by Reimar Döffinger %Reimar^Doeffinger&gmx*de! Modified: trunk/libdvdnav/src/dvdnav.c Modified: trunk/libdvdnav/src/dvdnav.c ============================================================================== --- trunk/libdvdnav/src/dvdnav.c Fri Oct 4 00:30:48 2013 (r1262) +++ trunk/libdvdnav/src/dvdnav.c Fri Oct 4 00:39:38 2013 (r1263) @@ -203,7 +203,7 @@ int64_t dvdnav_convert_time(dvd_time_t * int64_t result; int64_t frames; - result = (time->hour >> 4 ) * 10 * 60 * 60 * 90000; + result = (time->hour >> 4 ) * 10 * 60 * 60 * 90000ull; result += (time->hour & 0x0f) * 60 * 60 * 90000; result += (time->minute >> 4 ) * 10 * 60 * 90000; result += (time->minute & 0x0f) * 60 * 90000;

1 0

r1262 - trunk/libdvdnav/src/searching.c
by rathann 03 Oct '13

03 Oct '13

Author: rathann Date: Fri Oct 4 00:30:48 2013 New Revision: 1262 Log: Let dvdnav_describe_title_chapters() skip PGCs with a cell number of zero. Patch by Fabian Keil $fk%fabiankeil^de& Modified: trunk/libdvdnav/src/searching.c Modified: trunk/libdvdnav/src/searching.c ============================================================================== --- trunk/libdvdnav/src/searching.c Fri Oct 4 00:21:29 2013 (r1261) +++ trunk/libdvdnav/src/searching.c Fri Oct 4 00:30:48 2013 (r1262) @@ -630,6 +630,10 @@ uint32_t dvdnav_describe_title_chapters( goto fail; } + if (pgc->nr_of_cells == 0) { + printerr("Number of cells cannot be 0"); + continue; + } if ((cellnr = pgc->program_map[ptt[i].pgn-1]) == 0) { printerr("Cell new row cannot be 0"); continue;

1 0