search

windytan / slowrx

A decoder for Slow-Scanning Television (SSTV).
ISC License
98 stars 11 forks source link

Negative array indexing in GetFSK causes crash #4

Closed dnet closed 10 years ago

dnet commented 10 years ago

I was experimenting with the Pasokon P5 mode when I managed to generate such a WAV file that repeatedly crashed the FSK decoder when being played through the ALSA loopback. Since some variables were optimized out, I recompiled without -O3 and got the following.

Waiting for header
  VIS 114 (72h) @ +0 Hz
  ==== Pasokon P5 ====
  getvideo @ 44100,0 Hz, Skip 0, HedrShift +0 Hz

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffdecd7700 (LWP 5660)]
0x00000000004084c0 in GetFSK (dest=0x7fffdecd6c40 "") at fsk.c:49
49   for (i = 0; i < 970; i++) fft.in[i] = pcm.Buffer[pcm.WindowPtr+i- 485] * Hann[i];
(gdb) p i
$1 = 0
(gdb) p pcm
$2 = {handle = 0x92bf50, Buffer = 0x92c120, WindowPtr = 58, BufferDrop = 0}

As it can be seen above, WindowPtr is 58, i is 0, so the body of the for loop tries to access the 58+0-485=-427 index in the array, which causes segmentation fault. I couldn't manage to get it crash with Pasokon P3 using the same FSK sequence.

Since I didn't fully understand what was going on in the FSK decoder (with that -485 offset and other things) to fix this negative addressing, I report it here, the original image and the WAV file can be downloaded in a 20MB 7zip archive from http://vsza.hu/p5crash.7z and latter was generated from the former by executing the following command.

$ python -m pysstv --rate 44100 --fskid P5TEST --chan 2 \
    --mode PasokonP5 rgb640x496.jpg p5.wav
windytan commented 10 years ago

Hotfixed.