[asterisk-bugs] [Asterisk 0017193]: ast->tech_pvt->rtp contains garbage yielding SEGFAULT

[Asterisk Bug Tracker]

The following issue has been SUBMITTED. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17193 
====================================================================== 
Reported By:                wdoekes
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17193
Category:                   Channels/chan_sip/General
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.30 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-04-16 06:12 CDT
Last Modified:              2010-04-16 06:12 CDT
====================================================================== 
Summary:                    ast->tech_pvt->rtp contains garbage yielding
SEGFAULT
Description: 
Hi,

somehow I can get asterisk-1.4.30-rc3 and earlier (1.4.24) to SEGFAULT. I
haven't tried the 1.4.31-rc1 yet. But I don't think you've fixed anything
related there.

Backtrace info:

root at voip-test:/usr/src/asterisk-1.4.30-rc3# asterisk -V
Asterisk 1.4.30-rc3
root at voip-test:/usr/src/asterisk-1.4.30-rc3# gdb `which asterisk`
/root/asterisk-crash.core 
...
https://issues.asterisk.org/view.php?id=0  0x00007f92aedf2b66 in poll () from
/lib/libc.so.6
(gdb) thread 6
[Switching to thread 6 (process 26472)]https://issues.asterisk.org/view.php?id=0
 ast_rtp_write
(rtp=0x31202f2045544956, _f=0x42532f00) at rtp.c:2875
2875		if (!rtp->them.sin_addr.s_addr)
(gdb) bt
https://issues.asterisk.org/view.php?id=0  ast_rtp_write
(rtp=0x31202f2045544956, _f=0x42532f00) at rtp.c:2875
https://issues.asterisk.org/view.php?id=1  0x00007f9297996952 in sip_write
(ast=0x14e6360, frame=0x42532f00) at
chan_sip.c:3922
https://issues.asterisk.org/view.php?id=2  0x00007f9297996c55 in sip_rtp_prod
(data=<value optimized out>) at
chan_sip.c:4650
https://issues.asterisk.org/view.php?id=3  0x00000000004a92db in ast_sched_runq
(con=<value optimized out>) at
sched.c:363
https://issues.asterisk.org/view.php?id=4  0x00007f92979800fa in do_monitor
(data=<value optimized out>) at
chan_sip.c:17082
https://issues.asterisk.org/view.php?id=5  0x00000000004b6c7c in dummy_start
(data=<value optimized out>) at
utils.c:856
https://issues.asterisk.org/view.php?id=6  0x00007f92af75bfc7 in start_thread ()
from /lib/libpthread.so.0
https://issues.asterisk.org/view.php?id=7  0x00007f92aedfb5ad in clone () from
/lib/libc.so.6
https://issues.asterisk.org/view.php?id=8  0x0000000000000000 in ?? ()
(gdb) list
2874		/* If we have no peer, return immediately */	
2875		if (!rtp->them.sin_addr.s_addr)
2876			return 0;


That rtp value is garbage and therefore the process is killed when trying
to access it.
====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-04-16 06:12 wdoekes        New Issue                                    
2010-04-16 06:12 wdoekes        Asterisk Version          => 1.4.30          
2010-04-16 06:12 wdoekes        Regression                => No              
2010-04-16 06:12 wdoekes        SVN Branch (only for SVN checkouts, not tarball
releases) => N/A             
======================================================================