logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

OpenBeken addEventHandler buffer overrun issue—anyone able to replicate?

p.kaczmarek2 333 8
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply | New topic
  • #1 21716245
    p.kaczmarek2
    Moderator Smart Home  
    @divadiow @insmod
    We got such report in issue #1828:
    Quote:
    in the summary, when there are more than 3 event handlers, the 2nd event handler for some reason will do the action of the last event handler instead of its own action.

    version: Built on Oct 6 2025 07:36:23 version 1.18.189
    Device Tuya IR blaster S18 chip CB3S
    Chip/model: BK7231N
    Device config?
    this is the commands in startup:
    "
    startDriver IR
    setFlag 1 1
    addEventHandler2 IR_NEC 0xC7EA 0x17 backlog IRSend NEC 0x0 0xA8; IRSend NEC 0x0 0xA8; IRSend NEC 0x0 0xA8

    addEventHandler2 IR_NEC 0xC7EA 0xF backlog IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C;IRSend NEC 0x0 0x8C;IRSend NEC 0x0 0x8C

    addEventHandler2 IR_NEC 0xC7EA 0x10 backlog IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C;IRSend NEC 0x0 0x9C
    "

    when the device boot this is what happened:
    "
    Info:MAIN:Started IR.
    Info:CMD:CMD_StartScript: started @startup at the beginning
    Info:MAIN:Drv IR is already loaded.
    Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog IRSend NEC 0x0 0xA8; IRSend NEC 0x0 0xA8; IRSend NEC 0x0 0xA8
    Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C;IRSend NEC 0x0 0x9C
    Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C; IRSend NEC 0x0 0x9C;IRSend NEC 0x0 0x9C
    "

    the 2nd event handler supposed send 0x8C when triggered, but instead it sent 0x9C (which is the action of the 3rd event handler). if there are 4 eventhandlers, the 2nd event handler will do the 4th event handler's action.

    in the summary, the 2nd event handler for some reason will do the action of the last event handler instead of its own action.

    Are you able to replicate? I've tried with self test, but no luck so far:
    Visual Studio environment with C source code and IRSend debug console output.
    Looks like a possible buffer issue (overrun or something)
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #2 21716270
    insmod
    Level 29  
    >>21716245
    Wasn't able to replicate on bk7231n
  • #3 21716291
    p.kaczmarek2
    Moderator Smart Home  
    He's referring to startup command specifically, did you try there?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #4 21716294
    insmod
    Level 29  
    >>21716291
    Yes, even copied the whole command with startdriver and setflag.
  • ADVERTISEMENT
  • #5 21723627
    wenhuazhang2018
    Level 2  
    Thanks for working on this, here is an update and clarification:

    1) I rewrote the startup script:
    Code: text Expand Select all Copy to clipboard
    startDriver IR
setFlag 1 1
addEventHandler2 IR_NEC 0xC7EA 0x17 backlog delay_ms 50; IRSend NEC-0-A8-0-32

addEventHandler2 IR_NEC 0xC7EA 0xF backlog delay_ms 50; IRSend NEC-0-8C-0-32

addEventHandler2 IR_NEC 0xC7EA 0x10 backlog delay_ms 50; IRSend NEC-0-9C-0-32


    2) during startup it appears fine:

    Code: text Expand Select all Copy to clipboard
    Info:MAIN:Started IR.
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:MAIN:Drv IR is already loaded.
Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog delay_ms 50; IRSend NEC-0-A8-0-32
Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog delay_ms 50; IRSend NEC-0-8C-0-32
Info:EVENT:CMD_AddEventHandler: added IR_NEC with cmd backlog delay_ms 50; IRSend NEC-0-9C-0-32
Info:CMD:LFS_ReadFile: failed to file autoexec.bat
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done


    3) but during testing:

    Code: text Expand Select all Copy to clipboard
    Info:IR:IR IR_NEC 0xC7EA 0xF 0 (32 bits)
Info:EVENT:EventHandlers_FireEvent3: executing command  backlog delay_ms 50; IRSend NEC-0-9C-0-32
Info:IR:Delay 100ms
Info:IR:IR send NEC-0-9C-0-32 protocol 7 addr 0x0 cmd 0x9C repeats 0 bits override 50

    As you can see: 0xF event should send 8C, but it sent 9C instead.

    4) I reboot and test it multiple times, on rare occasions it tested fine, but in >90% case the above error will happen

    Added after 6 [minutes]:

    Also this is my template:

    Code: JSON
    Log in, to see the code
  • Helpful post
    #6 21724089
    max4elektroda
    Level 21  
    Maybe we can narrow the issue with some more debug.
    Could you try with the attached firmware and logging set to "Debug" or even "ExtraDebug"?
    If I did it right (can't test due to missing hardware) it should print out more of the details how the "matching" event handler is found.

    Something like this from simulator test

    Code: text Expand Select all Copy to clipboard
    
Debug:EVENT:DEBUG EventHandlers_FireEvent3: called with eventCode 84 address 0xEF00 command 0x0 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x6 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x5 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x4 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x10 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x1 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xEF00 command 0x0 repeat 0
Debug:EVENT:DEBUG EventHandlers_FireEvent3: found event match: address 0xEF00 command 0x0 repeat 0
Info:EVENT:EventHandlers_FireEvent3: executing command setChannel 12 1



    Updated attached firmware - extended "listeventhandlers" to show required arguments, too.
    Sample output for your code:
    Code: text Expand Select all Copy to clipboard
    
Info:EVENT:Event 0 has code 84 and command backlog delay_ms 50; IRSend NEC-0-9C-0-32. Required arguments: 51178 (0xc7ea), 16 (0x10), 0 (0x0)
Info:EVENT:Event 1 has code 84 and command backlog delay_ms 50; IRSend NEC-0-8C-0-32. Required arguments: 51178 (0xc7ea), 15 (0xf), 0 (0x0)
Info:EVENT:Event 2 has code 84 and command backlog delay_ms 50; IRSend NEC-0-A8-0-32. Required arguments: 51178 (0xc7ea), 23 (0x17), 0 (0x0)
    Attachments:
  • #7 21724098
    p.kaczmarek2
    Moderator Smart Home  
    Now you are showing code with delay_ms in backlog. This was recently implemented by stuffing backlog into a tiny script thread. Maybe that's the problem?

    Still, I added a delay_ms test in such a way but still no problem...
    https://github.com/openshwprojects/OpenBK7231...mmit/3a6d7bcecc2ff8d209f6a1c797056166c830e6a6
    Maybe something chip-specific
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #8 21725564
    wenhuazhang2018
    Level 2  
    Thanks for the suggestions, I have not tried the new firmware yet, but after remove the delay, everything seems fine now. (I restarted the device a few times each time it works fine)

    Code: text Expand Select all Copy to clipboard
    addEventHandler2 IR_NEC 0xC7EA 0x17 IRSend NEC-0-A8-0-32

addEventHandler2 IR_NEC 0xC7EA 0xF  IRSend NEC-0-8C-0-32

addEventHandler2 IR_NEC 0xC7EA 0x10 IRSend NEC-0-9C-0-32


    When I try to put delay back, I got the error again. I also tried this:

    Code: text Expand Select all Copy to clipboard
    addEventHandler2 IR_NEC 0xC7EA 0x17 backlog IRSend NEC-0-A8-0-32; delay_ms 100; IRSend NEC-0-A8-0-32

addEventHandler2 IR_NEC 0xC7EA 0xF backlog IRSend NEC 0x0 0x8C; delay_ms 50; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; addChannel 2 1

addEventHandler2 IR_NEC 0xC7EA 0x10 backlog IRSend NEC-0-9C-0-32; delay_ms 100; IRSend NEC-0-9C-0-32



    I got:
    Code: text Expand Select all Copy to clipboard
    Info:IR:IR IR_NEC 0xC7EA 0xF 0 (32 bits)
Info:EVENT:EventHandlers_FireEvent3: executing command  backlog IRSend NEC-0-9C-0-32; delay_ms 100; IRSend NEC-0-9C-0-32
Info:IR:Delay 100ms
Info:IR:IR send NEC-0-9C-0-32 protocol 7 addr 0x0 cmd 0x9C repeats 0 bits override 50
Info:IR:Delay 100ms
Info:IR:IR send NEC-0-9C-0-32 protocol 7 addr 0x0 cmd 0x9C repeats 0 bits override 50

    So "delay_ms" seems to be the problem


    related info and question:

    I am trying to transcode IR from Roku:


    power button
    Info:IR:IR IR_NEC 0xC7EA 0x17 0 (32 bits)
    Info:IR:IR IR_NEC2 0xC7EA 0x97 1 (32 bits)

    Vup
    Info:IR:IR IR_NEC 0xC7EA 0xF 0 (32 bits)
    Info:IR:IR IR_NEC2 0xC7EA 0x8F 1 (32 bits)

    Vdown
    Info:IR:IR IR_NEC 0xC7EA 0x10 1 (32 bits)
    Info:IR:IR IR_NEC2 0xC7EA 0x90 1 (32 bits)

    to Vankyo projector:

    power button
    Info:IR:IR IR_NEC 0x0 0xA8 0 (32 bits)
    Info:IR:IR IR_NEC 0x0 0xA8 1 (0 bits)

    Vup
    Info:IR:IR IR_NEC 0x0 0x8C 0 (32 bits)
    Info:IR:IR IR_NEC 0x0 0x8C 1 (0 bits)

    Vdown
    Info:IR:IR IR_NEC 0x0 0x9C 0 (32 bits)
    Info:IR:IR IR_NEC 0x0 0x9C 1 (0 bits)

    1) Is putting eventhandler at startup the right way to do it?
    2) When I try to do this:
    addEventHandler2 IR_NEC2 0xC7EA 0x8F IRSend NEC-0-8C-0-32
    I got an error:
    Error:EVENT: IR_NEC2 is not a valid event

    Added after 19 [minutes]:

    max4elektroda, I am trying the firmware you sent, there are 6 files in the zip, which one should I use?

    Added after 17 [minutes]:

    using this file to OTA "OpenBK7231N_irdebug_42e29b3f039a.rbl"
    and using this at startup:

    Code: text Expand Select all Copy to clipboard
    addEventHandler2 IR_NEC 0xC7EA 0x17 backlog IRSend NEC-0-A8-0-32; delay_ms 100; IRSend NEC-0-A8-0-32

addEventHandler2 IR_NEC 0xC7EA 0xF backlog IRSend NEC 0x0 0x8C; delay_ms 50; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; IRSend NEC 0x0 0x8C; addChannel 2 1

addEventHandler2 IR_NEC 0xC7EA 0x10 backlog IRSend NEC-0-9C-0-32; delay_ms 100; IRSend NEC-0-9C-0-32



    Here is the related logs: (showing the bug is there when there is "delay_ms 50" in the 0xF event, it did the action of the third event)

    Code: text Expand Select all Copy to clipboard
    Info:IR:IR IR_NEC 0xC7EA 0xF 0 (32 bits)
Debug:IR:DEBUG: Calling 'EventHandlers_FireEvent3(84, 0C7EA, 0F, 0)'
Debug:EVENT:DEBUG EventHandlers_FireEvent3: called with eventCode 84 address 0xC7EA command 0xF repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xC7EA command 0xF repeat 0
Debug:EVENT:DEBUG EventHandlers_FireEvent3: found event match: address 0xC7EA command 0xF repeat 0
Info:EVENT:EventHandlers_FireEvent3: executing command  backlog IRSend NEC-0-9C-0-32; delay_ms 100; IRSend NEC-0-9C-0-32
Debug:CMD:cmd [backlog IRSend NEC-0-9C-0-32; delay_ms 100; IRSend NEC-0-9C-0-32]
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xC7EA command 0x10 repeat 0
ExtraDebug:EVENT:DEBUG EventHandlers_FireEvent3: checking event for match: address 0xC7EA command 0x17 repeat 0
Debug:IR:IR fire event took 9ms
Debug:CMD:cmd [IRSend NEC-0-9C-0-32]
Info:IR:Delay 100ms
Info:IR:IR send NEC-0-9C-0-32 protocol 7 addr 0x0 cmd 0x9C repeats 0 bits override 50
Debug:CMD:cmd [delay_ms 100]
ExtraDebug:CMD:CMD_Delay_ms: thread will delay 100
Debug:CMD:cmd [IRSend NEC-0-9C-0-32]
Info:IR:Delay 100ms
Info:IR:IR send NEC-0-9C-0-32 protocol 7 addr 0x0 cmd 0x9C repeats 0 bits override 50
Debug:IR:IR decode returned true, protocol 8
Debug:IR:Address=0xC7EA Command=0x8F
Debug:IR:Repeat
Debug:IR: Gap 38050us
Debug:IR: Raw-Data=0x708FC7EA
Debug:IR: 32 bits
Debug:IR: LSB first
Debug:IR:IR decode returned true, protocol NEC2 (8)
Info:IR:IR IR_NEC2 0xC7EA 0x8F 1 (32 bits)
  • #9 21725573
    max4elektroda
    Level 21  
    If you still have the debug firmware:
    Could you please try "listeventhandlers" command to see what's saved as a command?
    Thanks!
Reply | New topic
Report a violation of the law

Topic summary

A report in issue #1828 suggests a potential buffer overrun problem related to the OpenBeken addEventHandler function, specifically triggered by a startup command sequence. Attempts to replicate the issue using self-tests, including the full startup command with startdriver and setflag parameters, have been unsuccessful on the bk7231n platform. The discussion focuses on verifying the reproducibility of the buffer issue during the initialization phase of the firmware.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT