BUG: Segmentation fault with iViewHD net camera

root@linuxtv:/home/admin/motion# ./motion -n -d 9
[0] [NTC] [ALL] conf_load: Processing thread 0 - config file /usr/local/etc/motion.conf
[0] [NTC] [ALL] config_thread: Processing config file /usr/local/etc/motion-cam3.conf
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "netcam_http"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "despeckle"
[0] [NTC] [ALL] motion_startup: Motion trunkREV557 Started with SDL support
[0] [NTC] [ALL] motion_startup: Logging to syslog
[0] [NTC] [ALL] motion_startup: Using default log type (ALL)
[0] [NTC] [ALL] motion_startup: Using log type (ALL) log level (ALL)
[0] [NTC] [ENC] ffmpeg_init: ffmpeg LIBAVCODEC_BUILD 3557988 LIBAVFORMAT_BUILD 3548516
[0] [NTC] [ALL] main: Thread 1 is from /usr/local/etc/motion-cam3.conf
[0] [NTC] [ALL] main: Thread 1 is device: http://10.0.0.12:8080/image.cgi?CAPTURE=YES&STREAM=1&COMMAND= input -1
[0] [NTC] [ALL] main: Stream port 82
[0] [NTC] [ALL] main: Waiting for threads to finish, pid: 17024
[1] [NTC] [ALL] motion_init: Thread 1 started , motion detection Enabled
[1] [ALR] [NET] netcam_start: Network Camera thread starting... for url (http://10.0.0.12:8080/image.cgi?CAPTURE=YES&STREAM=1&COMMAND=)
[1] [DBG] [NET] netcam_url_parse: Entry netcam_url_parse data http://10.0.0.12:8080/image.cgi?CAPTURE=YES&STREAM=1&COMMAND=
[1] [DBG] [NET] netcam_url_parse: Parse case 0 data http://10.0.0.12:8080/image.cgi?CAPTURE=YES&STREAM=1&COMMAND=
[1] [DBG] [NET] netcam_url_parse: Parse case 1 data http
[1] [DBG] [NET] netcam_url_parse: Parse case 6 data 10.0.0.12
[1] [DBG] [NET] netcam_url_parse: Parse case 7 data :8080
[1] [DBG] [NET] netcam_url_parse: Parse case 8 data 8080
[1] [DBG] [NET] netcam_url_parse: Parse case 9 data /image.cgi?CAPTURE=YES&STREAM=1&COMMAND=
[1] [INF] [NET] netcam_start: Netcam_http parameter 'off' converts to flags: HTTP/1.0: 1 HTTP/1.1: 0 Keep-Alive OFF.
[1] [INF] [NET] netcam_start: now calling netcam_setup_html()
[1] [INF] [NET] netcam_http_build_url: Netcam has flags: HTTP/1.0: 1 HTTP/1.1: 0 Keep-Alive OFF.
[1] [INF] [NET] netcam_http_build_url: Camera connect string is ''GET /image.cgi?CAPTURE=YES&STREAM=1&COMMAND= HTTP/1.0
Host: 10.0.0.12
User-Agent: Motion-netcam/trunkREV557
Connection: close

'' End of camera connect string.
[1] [INF] [NET] netcam_http_request: about to try to connect, time #0
[1] [INF] [NET] netcam_connect: disconnecting netcam since keep-alive not set.
[1] [INF] [NET] netcam_connect: with no keepalive, new socket created fd 3
[1] [INF] [NET] netcam_connect: re-using socket 3 since keepalive is set.
[1] [INF] [NET] netcam_read_first_header: Received first header ('HTTP/1.0 200 OK')
[1] [INF] [NET] netcam_read_first_header: Received first header ('Server: iViewHD Camera/2.0')
[1] [INF] [NET] netcam_check_content_length: Content-Length -1
[1] [INF] [NET] netcam_read_first_header: Received first header ('Expires: 0')
[1] [INF] [NET] netcam_check_content_length: Content-Length -1
[1] [INF] [NET] netcam_read_first_header: Received first header ('Cache-Control: no-cache, private')
[1] [INF] [NET] netcam_check_content_length: Content-Length -1
[1] [INF] [NET] netcam_read_first_header: Received first header ('Pragma: no-cache')
[1] [INF] [NET] netcam_check_content_length: Content-Length -1
[1] [INF] [NET] netcam_read_first_header: Received first header ('Content-type: multipart/x-mixed-replace;boundary=iViewHD-Image-Boundary')
[1] [INF] [NET] netcam_check_content_type: Content-type multipart/x-mixed-replace
[1] [INF] [NET] netcam_read_first_header: Streaming camera
[1] [INF] [NET] netcam_read_first_header: Boundary string [iViewHD-Image-Boundary]
[1] [INF] [NET] netcam_read_first_header: Received first header ('')
[1] [INF] [NET] netcam_check_content_length: Content-Length 44055
[1] [INF] [NET] netcam_check_content_type: Content-type image/jpeg
[1] [INF] [NET] netcam_check_content_length: Content-Length -1
[1] [INF] [NET] netcam_read_next_header: Found image header record
[1] [NTC] [NET] netcam_setup_html: connected, going on to read image.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [0/0] to [0/4096] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [4092/4096] to [4092/8192] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [6996/8192] to [6996/12288] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [11352/12288] to [11352/16384] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [15708/16384] to [15708/20480] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [20064/20480] to [20064/24576] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [24420/24576] to [24420/28672] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [27324/28672] to [27324/32768] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [31680/32768] to [31680/36864] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [36036/36864] to [36036/40960] bytes.
[1] [DBG] [NET] netcam_check_buffsize: expanding buffer from [40392/40960] to [40392/45056] bytes.
[1] [INF] [NET] netcam_init_jpeg: jpeg_error 0
[1] [INF] [NET] netcam_get_dimensions: JFIF_marker IS PRESENT ret 0
[1] [CRT] [NET] netcam_start: netcam image height (536) is not modulo 16
[1] [NTC] [ALL] image_ring_resize: Resizing pre_capture buffer to 1 items
[1] [NTC] [STR] http_bindsock: motion-stream testing : IPV4 addr: 0.0.0.0 port: 82
[1] [NTC] [STR] http_bindsock: motion-stream Bound : IPV4 addr: 0.0.0.0 port: 82
[1] [NTC] [ALL] motion_init: Started motion-stream server in port 82 auth Disabled
[1] [NTC] [ALL] image_ring_resize: Resizing pre_capture buffer to 2 items
[1] [DBG] [ALL] motion_loop: vid_return_code 1
Segmentation fault (core dumped)

Environment

Follow up

root@linuxtv:/home/admin/motion# gdb motion /tmp/core.motion.17024
GNU gdb (GDB) 7.5
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-slackware-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/admin/motion/motion...done.
[New LWP 17025]
[New LWP 17024]

warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `./motion -n -d 9'.
Program terminated with signal 11, Segmentation fault.
#0  0x000000000040e501 in draw_textn (image=0x7fa2f0000e10 "", startx=4294967144, starty=11, width=0, text=0x7fa2f66ddcb0 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13", len=25, factor=0) at draw.c:1115
1115                        *image_ptr = 0;
(gdb) bt full
#0  0x000000000040e501 in draw_textn (image=0x7fa2f0000e10 "", startx=4294967144, starty=11, width=0, text=0x7fa2f66ddcb0 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13", len=25, factor=0) at draw.c:1115
        pos_check = 85
        pos = 0
        x = 5
        y = 7
        line_offset = -7
        next_char_offs = -6
        image_ptr = 0x7fa3f0000d79 <Address 0x7fa3f0000d79 out of bounds>
        char_ptr = 0x64a3dc <draw_table+4220> "\001"
        char_arr_ptr = 0x66bd80 <small_char_arr_ptr>
#1  0x000000000040e61a in draw_text (image=0x7fa2f0000e10 "", startx=10, starty=11, width=0, text=0x7fa2f66ddcb0 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13", factor=0) at draw.c:1159
        len = 27
        num_nl = 1
        end = 0x7fa2f66ddccb "\\nSINCE 2012-11-21 15:54:13"
        begin = 0x7fa2f66ddcb0 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13"
        line_space = 9
#2  0x0000000000407d49 in motion_loop (arg=0x20ca9c0) at motion.c:1467
        tmpin = 0x434710 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE %Y-%m-%d %T"
        tmpout = "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13", '\000' <repeats 25 times>
        tmptime = {tm_sec = 13, tm_min = 54, tm_hour = 15, tm_mday = 21, tm_mon = 10, tm_year = 112, tm_wday = 3, tm_yday = 325, tm_isdst = 0, tm_gmtoff = -25200, tm_zone = 0x20ca1b0 "MST"}
        cnt = 0x20ca9c0
        i = 32674
        j = 50
        z = 0
        lastframetime = 1353538453
        frame_buffer_size = 2
        rate_limit = 1
        area_once = 0
        area_minx = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_miny = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_maxx = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_maxy = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        smartmask_ratio = 0
        smartmask_count = 20
        smartmask_lastrate = 0
        olddiffs = 0
        previous_diffs = 0
        previous_location_x = 0
        previous_location_y = 0
        text_size_factor = 1
        passflag = 0
        rolling_average_data = 0x7fa2f0000b50
        rolling_average_limit = 50
        required_frame_time = 200000
        frame_delay = 200000
        delay_time_nsec = 140337929221976
        rolling_frame = 0
        tv1 = {tv_sec = 1353538453, tv_usec = 498060}
        tv2 = {tv_sec = 5, tv_usec = 0}
        rolling_average = 5
        elapsedtime = 0
        timenow = 1353538453498060
        timebefore = 0
        vid_return_code = 1
        minimum_frame_time_downcounter = 0
        get_image = 1
        old_image = 0x0
        time_last_frame = 1
---Type <return> to continue, or q <return> to quit---
        time_current_frame = 0
        __FUNCTION__ = "motion_loop"
#3  0x00007fa2fbce000e in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#4  0x00007fa2f87a2a7d in clone () from /lib64/libc.so.6
No symbol table info available.
(gdb) frame 1
#1  0x000000000040e61a in draw_text (image=0x7fa2f0000e10 "", startx=10, starty=11, width=0, text=0x7fa2f66ddcb0 "UNABLE TO OPEN VIDEO DEVICE\\nSINCE 2012-11-21 15:54:13", factor=0) at draw.c:1159
1159            draw_textn(image, startx, starty, width, begin, len, factor);
(gdb)

Fix record