[asterisk-bugs] [Asterisk 0019192]: [patch] [regression] segfault in _sip_tcp_helper_thread() caused by bad merge in r314628

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=19192 
====================================================================== 
Reported By:                stknob
Assigned To:                mnicholson
====================================================================== 
Project:                    Asterisk
Issue ID:                   19192
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   block
Priority:                   normal
Status:                     closed
Target Version:             1.8.5
Asterisk Version:           1.8.3.3 
JIRA:                       SWP-3390 
Regression:                 Yes 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2011-04-27 11:43 CDT
Last Modified:              2011-05-16 10:53 CDT
====================================================================== 
Summary:                    [patch] [regression] segfault in
_sip_tcp_helper_thread() caused by bad merge in r314628
Description: 
This happens if ast_tcptls_session_start() in _sip_tcp_helper_thread() on
line 2506 in chan_sip.c fails (returns NULL).

To reproduce, 
  - create a tcp sip peer that can not be reached (e.g. blocked by
firewall)
  - use sip qualify peer X  (or set qualify=yes in sip.conf)

chan_sip will try to create the connection by calling
ast_tcptls_session_start().
the connection fails and ast_tcptls_session_start() returns NULL:

   if ((!(ca = tcptls_session->parent)) ||
        (!(me = ao2_t_find(threadt, &tmp, OBJ_POINTER, "ao2_find, getting
sip_threadinfo in tcp helper thread"))) ||
         (!(tcptls_session = ast_tcptls_client_start(tcptls_session)))) {
               goto cleanup;
   }

setting tcptls_session to NULL and jumping to cleanup:

   cleanup:
        if (!tcptls_session->client && !authenticated) {
                ast_atomic_fetchadd_int(&unauth_sessions, -1);
        }

*boom*
asterisk[8204]: segfault at 18 ip 00007f497d4499f0 sp 00007f4966ef5450
error 4 in chan_sip.so[7f497d3c7000+a6000]
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
has duplicate       0019290 Asterisk Crashing
child of            0019182 [patch] [regression] Asterisk drops sip...
====================================================================== 

---------------------------------------------------------------------- 
 (0134976) svnbot (reporter) - 2011-05-16 10:53
 https://issues.asterisk.org/view.php?id=19192#c134976 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 319142

U   branches/1.8/channels/chan_sip.c

------------------------------------------------------------------------
r319142 | mnicholson | 2011-05-16 10:53:27 -0500 (Mon, 16 May 2011) | 8
lines

Make sure tcptls_session exists before dereferencing it.

(closes issue https://issues.asterisk.org/view.php?id=19192)
Reported by: stknob
Patches:
      10-tcptls-unreachable-peer-segfault.patch uploaded by Chainsaw
(license 723)
Tested by: vois, Chainsaw

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=319142 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-05-16 10:53 svnbot         Checkin                                      
2011-05-16 10:53 svnbot         Note Added: 0134976                          
======================================================================