[asterisk-bugs] [JIRA] (ASTERISK-22805) res_rtp_asterisk: Crash when calling BIO_ctrl_pending in dtls_srtp_check_pending when dialed by JSSIP

[JoshE (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-22805?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

JoshE updated ASTERISK-22805:
-----------------------------

    Attachment: bt_udptl.txt

This may not be 100% related to this, as I have been messing with ASTERISK-22961, but I've also found this crash path.  This is on sending an outbound call from Asterisk to an off premise analog fax machine with faxdetect=yes on the peer.

Is 100% reproducible at this point.

> res_rtp_asterisk: Crash when calling BIO_ctrl_pending in dtls_srtp_check_pending when dialed by JSSIP 
> ------------------------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-22805
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-22805
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_sip/General, Resources/res_rtp_asterisk
>    Affects Versions: 11.5.1, 11.6.0, 11.7.0
>         Environment: Linux 2.6.32-358.18.1.el6.x86_64, OpenSSL 1.0.1e-fips 11 Feb 2013, srtp 1.4.4
>            Reporter: Dmitry Burilov
>            Severity: Critical
>         Attachments: backtrace2.txt, backtrace.txt, bt_udptl.txt, coredump.tar.bz2, sip.conf
>
>
> Dial from Chrome 30.0.1599.101m via jssip application crash asterisk11.
> -----------gdb output ----------------
> Core was generated by `/usr/sbin/asterisk -f -vvvg -c'.
> Program terminated with signal 11, Segmentation fault.
> #0  0x00007f1353750875 in BIO_ctrl (b=0x7f132403bd80, cmd=10, larg=0, parg=0x0) at bio_lib.c:367
> 367			((ret=cb(b,BIO_CB_CTRL,parg,cmd,larg,1L)) <= 0))
> ----------------------------
> ----------- and ------------
> #0  BIO_ctrl (b=0x7f824404ec30, cmd=10, larg=0, parg=0x0) at bio_lib.c:370
> 370		ret=b->method->ctrl(b,cmd,larg,parg);
> [?1034h(gdb) frame 1
> #1  0x00007f82d3ac3702 in dtls_srtp_check_pending (instance=0x7f824403e158, rtp=0x7f8244043360) at res_rtp_asterisk.c:1258
> 1258		size_t pending = BIO_ctrl_pending(rtp->write_bio);
> (gdb) info frame 1
> Stack frame at 0x7f82cc914dd0:
>  rip = 0x7f82d3ac3702 in dtls_srtp_check_pending (res_rtp_asterisk.c:1258); saved rip 0x7f82d3ac40e6
>  called by frame at 0x7f82cc914f20, caller of frame at 0x7f82cc914cd0
>  source language c.
>  Arglist at 0x7f82cc914dc0, args: instance=0x7f824403e158, rtp=0x7f8244043360
>  Locals at 0x7f82cc914dc0, Previous frame's sp is 0x7f82cc914dd0
>  Saved registers:
>   rbx at 0x7f82cc914db0, rbp at 0x7f82cc914dc0, r12 at 0x7f82cc914db8, rip at 0x7f82cc914dc8
> ----------------------------



--
This message was sent by Atlassian JIRA
(v6.2#6252)