vdr[75260]: double free or corruption (out)

[MarkusEh]

Hallo,

vdr stürzt ab, mit der Meldung "vdr[75260]: double free or corruption (out)".
Mediaclient -e:

**** List of Media Hardware Devices ****
device 0: [Sundtek SkyTV Ultimate II (USB 2.0)]  DVB-S/S2, REMOTE-CONTROL
  [INFO]:
     STATUS: STANDBY
  [BUS]:
     ID: 2-3
  [SERIAL]:
     ID: U110927104102
  [DVB-S/S2]:
     FESTATUS: STANDBY
     FRONTEND: /dev/dvb/adapter0/frontend0
     DVR: /dev/dvb/adapter0/dvr0
     DMX: /dev/dvb/adapter0/demux0
  [REMOTECONTROL]:
     INPUT0: /dev/mediainput0

device 1: [Sundtek SkyTV Ultimate II (USB 2.0)]  DVB-S/S2, REMOTE-CONTROL
  [INFO]:
     STATUS: STANDBY
  [BUS]:
     ID: 2-6
  [SERIAL]:
     ID: U110927104037
  [DVB-S/S2]:
     FESTATUS: STANDBY
     FRONTEND: /dev/dvb/adapter1/frontend0
     DVR: /dev/dvb/adapter1/dvr0
     DMX: /dev/dvb/adapter1/demux0
  [REMOTECONTROL]:
     INPUT0: /dev/mediainput1

backtrace:

#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

set = {__val = {0, 80, 4, 94792703908451, 140632690873040, 4, 4, 7904, 140632933895072, 140633426445392, 8, 140633703069807, 94792703906928, 8, 7307199742750123385, 140633426445392}}

pid = <optimized out>

tid = <optimized out>

#1 0x00007fe7d5e80859 in __GI_abort () at abort.c:79

save_stage = 1

act =

{__sigaction_handler = {sa_handler = 0x62696c2f7273752f, sa_sigaction = 0x62696c2f7273752f}, sa_mask = {__val = {31, 31, 7904, 140632933894856, 140633426445392, 8, 140633703069807, 94792703906928, 8, 140633704570923, 140633426445392, 140632933894608, 0, 62, 140632690964048, 140633426444800}}, sa_flags = 62, sa_restorer = 0x3e}

sigs = {__val = {32, 0 <repeats 15 times>}}

#2 0x00007fe7d5eeb3ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7fe7d6015285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155

ap = {{gp_offset = 24, fp_offset = 0, overflow_arg_area = 0x7fe7c56d4320, reg_save_area = 0x7fe7c56d42b0}}

fd = <optimized out>

list = <optimized out>

nlist = <optimized out>

cp = <optimized out>

#3 0x00007fe7d5ef347c in malloc_printerr (str=str@entry=0x7fe7d6017670 "double free or corruption (out)") at malloc.c:5347

#4 0x00007fe7d5ef5120 in _int_free (av=0x7fe7d6046b80 <main_arena>, p=0x7fe7a80e85b0, have_lock=<optimized out>) at malloc.c:4314

size = 384

fb = <optimized out>

nextchunk = 0x7fe7a80e8730

nextsize = <optimized out>

nextinuse = <optimized out>

prevsize = <optimized out>

bck = <optimized out>

fwd = <optimized out>

__PRETTY_FUNCTION__ = "_int_free"

#5 0x00007fe7d662b1e9 in () at /opt/lib/libmediaclient.so

#6 0x00007fe7d66233cd in close () at /opt/lib/libmediaclient.so

#7 0x00005636a56e6651 in cSectionHandler::Del(cFilterData const*) (this=0x5636a639d610, FilterData=FilterData@entry=0x7fe799ba22c0) at sections.c:108

fh = 0x7fe79bca04b0

#8 0x00005636a5690650 in cFilter::Del(unsigned short, unsigned char, unsigned char) (this=this@entry=0x5636a63a6330, Pid=<optimized out>, Tid=Tid@entry=2 '\002', Mask=Mask@entry=255 '\377')

at filter.c:229

fd = 0x7fe799ba22c0

#9 0x00005636a56cd3d7 in cPatFilter::SwitchToNextPmtPid() (this=this@entry=0x5636a63a6330) at pat.c:410

#10 0x00005636a56cebe9 in cPatFilter::Process(unsigned short, unsigned char, unsigned char const*, int)

(this=0x5636a63a6330, Pid=<optimized out>, Tid=<optimized out>, Data=0x7fe7c56d4dc0 "\002\260;n\322\301", Length=<optimized out>) at pat.c:479

pmt =

{<SI::NumberedSection> = {<SI::CRCSection> = {<SI::Section> = {<SI::Object> = {<SI::Parsable> = {_vptr.Parsable = 0x5636a5798bb0 <vtable for SI::PMT+16>, parsed = true}, data = {data_ = 0x7fe799c63f80, off = 0}}, <No data fields>}, <No data fields>}, <No data fields>}, commonDescriptors = {<SI::Loop> = {<SI::VariableLengthPart> = {<SI::Object> = {<SI::Parsable> = {_vptr.Parsable = 0x5636a57927d0 <vtable for SI::DescriptorLoop+16>, parsed = false}, data = {data_ = 0x7fe799c63f80, off = 12}}, length = 0}, <No data fields>}, domain = SI::SI}, streamLoop = {<SI::Loop> = {<SI::VariableLengthPart> = {<SI::Object> = {<SI::Parsable> = {_vptr.Parsable = 0x5636a57958c0 <vtable for SI::StructureLoop<SI::PMT::Stream>+16>, parsed = false}, data = {data_ = 0x7fe799c63f80, off = 12}}, length = 46}, <No data fields>}, <No data fields>}, s = 0x7fe7c56d4dc0}

StateKey = {stateLock = 0x3d600010000, write = 100, state = 0, timedOut = 240}

Channels = <optimized out>

Channel = <optimized out>

ChannelsModified = <optimized out>

MutexLock = {mutex = 0x5636a63a63e8, locked = true}

#11 0x00005636a56e6b56 in cSectionHandler::Action() (this=0x5636a639d610) at sections.c:211

fi = 0x5636a63a6330

pid = 330

tid = 2

len = 62

buf = "\002\260;n\322\301\000\000\341K\360\000$\341K\360\003R\001\037\021\341L\360\tR\001 \n\004deu\000\021\341M\360\tR\001!\n\004deu\000\005\341R\360\005o\003\000\020\340BC,\270\005Die besten Zoogeschichten aus NRWi\003\373\062\031P\016\365\v\tdeuHD-VideoP\f\362\003\002deustereoP\033\362\003\004deuohne AudiodeskriptionP\027\364B\021deuDolby Digital 2.0P\031\363 \006deuohne DV"...

r = <optimized out>

fh = <optimized out>

ThreadLock = {thread = 0x5636a639d610, locked = true}

i = <optimized out>

DeviceHasLock = true

NumFilters = <optimized out>

pfd = <optimized out>

oldStatusCount = 6031

#12 0x00005636a570fde5 in cThread::StartThread(cThread*) (Thread=0x5636a639d610) at thread.c:301
#13 0x00007fe7d6567609 in start_thread (arg=<optimized out>) at pthread_create.c:477

ret = <optimized out>

pd = <optimized out>

unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140633426454272, -2587623203588688243, 140732040950878, 140732040950879, 140732040950880, 140633426452224, 2583202227297040013, 2583173699283433101}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}

not_first_call = 0

#14 0x00007fe7d5f7d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[Sundtek]

VDR schließt Filter und benutzt die Instanzen im Nachhinein noch weiter und verursacht Memory Corruptions, der Bug liegt im VDR (sollte da noch weitere Hilfe benötigt werden lass es uns wissen).