[asterisk-bugs] [JIRA] (ASTERISK-20856) Segmentation fault in res_rtp_asterisk.so

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-20856?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=201400#comment-201400 ] 

Matt Jordan commented on ASTERISK-20856:
----------------------------------------

The problem here is that a media frame with a NULL data pointer was written out to the SIP channel. Channel drivers shouldn't be queuing up media frames with no data.

In this particular case, it appears as if the culprit was an analog channel, since the thread that started this was in sig_analog.
                
> Segmentation fault in res_rtp_asterisk.so
> -----------------------------------------
>
>                 Key: ASTERISK-20856
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-20856
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_asterisk
>            Reporter: Roberto Casas
>            Assignee: Roberto Casas
>            Severity: Critical
>         Attachments: backtrace.txt, debug.log, messages.log
>
>
> I have this bug in Asterisk 1.8.3.1 but I've inspected trunk version and the code is almost the same.
> The bug is in the function:
> ast_rtp_raw_write
> When we have a remote_address, but frame->data.ptr should be 0 (because substracting hdrlen gives position 0xfffffffffffffff4 to the rtpheader variable)

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira