[asterisk-bugs] [JIRA] (ASTERISK-22867) res_rtp_asterisk: Crash when calling BIO_ctrl_pending in dtls_srtp_check_pending when dialed by JSSIP

[Rusty Newton (JIRA)]

Rusty Newton created ASTERISK-22867:
---------------------------------------

             Summary: res_rtp_asterisk: Crash when calling BIO_ctrl_pending in dtls_srtp_check_pending when dialed by JSSIP 
                 Key: ASTERISK-22867
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-22867
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Channels/chan_sip/General, Resources/res_rtp_asterisk
    Affects Versions: 11.5.1, 11.6.0, 11.7.0
         Environment: Linux 2.6.32-358.18.1.el6.x86_64, OpenSSL 1.0.1e-fips 11 Feb 2013, srtp 1.4.4
            Reporter: Dmitry Burilov
            Severity: Critical


Dial from Chrome 30.0.1599.101m via jssip application crash asterisk11.

-----------gdb output ----------------
Core was generated by `/usr/sbin/asterisk -f -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f1353750875 in BIO_ctrl (b=0x7f132403bd80, cmd=10, larg=0, parg=0x0) at bio_lib.c:367
367			((ret=cb(b,BIO_CB_CTRL,parg,cmd,larg,1L)) <= 0))
----------------------------
----------- and ------------
#0  BIO_ctrl (b=0x7f824404ec30, cmd=10, larg=0, parg=0x0) at bio_lib.c:370
370		ret=b->method->ctrl(b,cmd,larg,parg);
[?1034h(gdb) frame 1
#1  0x00007f82d3ac3702 in dtls_srtp_check_pending (instance=0x7f824403e158, rtp=0x7f8244043360) at res_rtp_asterisk.c:1258
1258		size_t pending = BIO_ctrl_pending(rtp->write_bio);
(gdb) info frame 1
Stack frame at 0x7f82cc914dd0:
 rip = 0x7f82d3ac3702 in dtls_srtp_check_pending (res_rtp_asterisk.c:1258); saved rip 0x7f82d3ac40e6
 called by frame at 0x7f82cc914f20, caller of frame at 0x7f82cc914cd0
 source language c.
 Arglist at 0x7f82cc914dc0, args: instance=0x7f824403e158, rtp=0x7f8244043360
 Locals at 0x7f82cc914dc0, Previous frame's sp is 0x7f82cc914dd0
 Saved registers:
  rbx at 0x7f82cc914db0, rbp at 0x7f82cc914dc0, r12 at 0x7f82cc914db8, rip at 0x7f82cc914dc8
----------------------------

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira