[asterisk-bugs] [JIRA] (ASTERISK-23310) bridged channel crashes in bridge_p2p_rtp_write

[Kinsey Moore (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-23310?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Kinsey Moore updated ASTERISK-23310:
------------------------------------

    Attachment: ASTERISK-23310.diff

Hi Jeremy,
Could you test the attached patch?

It looks like what is happening is that when the bad side fails the remote bridging attempt, everything that was initialized for the attempt was not cleared out appropriately and the good channel ended up with a non-refcounted pointer to the bad channel's RTP instance which would normally be cleared out upon exit from the remote bridge attempt. This only caused things to blow up once the bad channel actually got destroyed since the bad channel was still holding a reference to the instance.

> bridged channel crashes in bridge_p2p_rtp_write
> -----------------------------------------------
>
>                 Key: ASTERISK-23310
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23310
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_asterisk
>    Affects Versions: 11.7.0
>         Environment: Debian wheezy
>            Reporter: Jeremy Lainé
>            Assignee: Kinsey Moore
>         Attachments: ASTERISK-23310.diff, broken-peer, crash-backtrace.txt, extensions.conf, refcount-and-log.tar.gz, sip.conf
>
>
> I have encountered numerous crashes using Bridge, which always involve bridge_p2p_rtp_write. To sumarize the setup:
> - two calls are fired up via Originate (one to an operator, one to a contact)
> - the operator gets put into an extension which basically does Answer + Wait(1800)
> - when the contact picks up, he gets bridged to the operator
> - the contact hangs up => the operator returns to the extension and waits some more
> .. and at some point things fall apart, and I start getting "bad magic number" warnings and eventually asterisk crashes, but always in bridge_p2p_rtp_write.
> An example:
> [Feb 14 15:47:15] DEBUG[25480][C-00000196] res_rtp_asterisk.c: Remote address is null, most likely RTP has been stopped
> [Feb 14 15:47:15] DEBUG[25480][C-00000196] res_rtp_asterisk.c: Remote address is null, most likely RTP has been stopped
> [Feb 14 15:47:15] DEBUG[25480][C-00000196] res_rtp_asterisk.c: Remote address is null, most likely RTP has been stopped
> [Feb 14 15:47:15] DEBUG[24287] chan_sip.c: Auto destroying SIP dialog '13e862723108b2aa2dbf50f14b7327ed at MY.IP.ADDRESS.HERE:5060'
> [Feb 14 15:47:15] DEBUG[24287] chan_sip.c: Destroying SIP dialog 13e862723108b2aa2dbf50f14b7327ed at MY.IP.ADDRESS.HERE:5060
> [Feb 14 15:47:15] VERBOSE[24287] chan_sip.c: Really destroying SIP dialog '13e862723108b2aa2dbf50f14b7327ed at MY.IP.ADDRESS.HERE:5060' Method: BYE
> [Feb 14 15:47:15] DEBUG[24287] rtp_engine.c: Destroyed RTP instance '0x7f5b980d17b8'
> [Feb 14 15:47:15] ERROR[25480][C-00000196] astobj2.c: bad magic number for object 0x7f5b98146488. Object is likely destroyed.
> [Feb 14 15:47:15] ERROR[25480][C-00000196] astobj2.c: bad magic number for object 0x7f5b98146488. Object is likely destroyed.
> [Feb 14 15:47:15] DEBUG[25480][C-00000196] res_rtp_asterisk.c: Unsupported payload type received



--
This message was sent by Atlassian JIRA
(v6.2#6252)