[asterisk-bugs] [Asterisk 0019192]: [patch] [regression] segfault in _sip_tcp_helper_thread() caused by bad merge in r314628

[Asterisk Bug Tracker]

The following issue has been ASSIGNED. 
====================================================================== 
https://issues.asterisk.org/view.php?id=19192 
====================================================================== 
Reported By:                stknob
Assigned To:                lmadsen
====================================================================== 
Project:                    Asterisk
Issue ID:                   19192
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   block
Priority:                   normal
Status:                     ready for testing
Target Version:             1.8.5
Asterisk Version:           1.8.3.3 
JIRA:                       SWP-3390 
Regression:                 Yes 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2011-04-27 11:43 CDT
Last Modified:              2011-05-13 13:51 CDT
====================================================================== 
Summary:                    [patch] [regression] segfault in
_sip_tcp_helper_thread() caused by bad merge in r314628
Description: 
This happens if ast_tcptls_session_start() in _sip_tcp_helper_thread() on
line 2506 in chan_sip.c fails (returns NULL).

To reproduce, 
  - create a tcp sip peer that can not be reached (e.g. blocked by
firewall)
  - use sip qualify peer X  (or set qualify=yes in sip.conf)

chan_sip will try to create the connection by calling
ast_tcptls_session_start().
the connection fails and ast_tcptls_session_start() returns NULL:

   if ((!(ca = tcptls_session->parent)) ||
        (!(me = ao2_t_find(threadt, &tmp, OBJ_POINTER, "ao2_find, getting
sip_threadinfo in tcp helper thread"))) ||
         (!(tcptls_session = ast_tcptls_client_start(tcptls_session)))) {
               goto cleanup;
   }

setting tcptls_session to NULL and jumping to cleanup:

   cleanup:
        if (!tcptls_session->client && !authenticated) {
                ast_atomic_fetchadd_int(&unauth_sessions, -1);
        }

*boom*
asterisk[8204]: segfault at 18 ip 00007f497d4499f0 sp 00007f4966ef5450
error 4 in chan_sip.so[7f497d3c7000+a6000]
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
duplicate of        0019272 [patch] remote authenticated asterisk D...
related to          0019282 [crash] SegFault / TCP enabled in _sip_...
has duplicate       0019290 Asterisk Crashing
====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-05-13 13:51 lmadsen        Assigned To               => lmadsen         
======================================================================