[asterisk-bugs] [JIRA] (ASTERISK-24963) ASAN: heap-use-after-free with PJSIP and WSS

[Badalian Vyacheslav (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-24963?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=225894#comment-225894 ] 

Badalian Vyacheslav commented on ASTERISK-24963:
------------------------------------------------

Another one place in simple call to WSS

{code}
==21478==ERROR: AddressSanitizer: heap-use-after-free on address 0x62200000da80 at pc 0x7f1d9bcc1ca6 bp 0x7f1db0b4cb50 sp 0x7f1db0b4cb48
READ of size 8 at 0x62200000da80 thread T34
    #0 0x7f1d9bcc1ca5 in ws_destroy /home/obs/asterisk-13.3.2/res/res_pjsip_transport_websocket.c:93
    #1 0x7f1db8217575 in destroy_transport (/usr/lib/libpjsip.so.2+0x1d575)
    #2 0x7f1db8219b1e in pjsip_transport_destroy (/usr/lib/libpjsip.so.2+0x1fb1e)
    #3 0x7f1db68e4c96 in pj_timer_heap_poll (/usr/lib/libpj.so.2+0x1dc96)
    #4 0x7f1db82130ca in pjsip_endpt_handle_events2 (/usr/lib/libpjsip.so.2+0x190ca)
    #5 0x7f1db4369356 in monitor_thread_exec /home/obs/asterisk-13.3.2/res/res_pjsip.c:3170
    #6 0x7f1db68d5df5 in thread_main (/usr/lib/libpj.so.2+0xedf5)
    #7 0x31a3e079d0 in start_thread (/lib64/libpthread.so.0+0x31a3e079d0)
    #8 0x31a36e88fc in clone (/lib64/libc.so.6+0x31a36e88fc)

0x62200000da80 is located 107889578525472 bytes inside
{code}

> ASAN: heap-use-after-free with PJSIP and WSS
> --------------------------------------------
>
>                 Key: ASTERISK-24963
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24963
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: pjproject/pjsip, Resources/res_http_websocket
>    Affects Versions: 13.3.2
>            Reporter: Badalian Vyacheslav
>
> {code}
> =================================================================
> ==20692==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200016c594 at pc 0x4956e0 bp 0x7f4dea2566a0 sp 0x7f4dea256698
> READ of size 4 at 0x61200016c594 thread T29
>     #0 0x4956df in INTERNAL_OBJ /home/obs/asterisk-13.3.2/main/astobj2.c:121
>     #1 0x4957b9 in __ao2_lock /home/obs/asterisk-13.3.2/main/astobj2.c:151
>     #2 0x7f4df41a2a90 in __ast_websocket_write /home/obs/asterisk-13.3.2/res/res_http_websocket.c:303
>     #3 0x7f4ddbf62352 in ws_send_msg /home/obs/asterisk-13.3.2/res/res_pjsip_transport_websocket.c:67
>     #4 0x7f4df84ba473 in pjsip_transport_send (/usr/lib/libpjsip.so.2+0x1e473)
>     #5 0x7f4df84b8104 in pjsip_endpt_send_response (/usr/lib/libpjsip.so.2+0x1c104)
>     #6 0x7f4df84b81eb in pjsip_endpt_send_response2 (/usr/lib/libpjsip.so.2+0x1c1eb)
>     #7 0x7f4df462d424 in authenticate res_pjsip/pjsip_distributor.c:317
>     #8 0x7f4df84b533a in pjsip_endpt_process_rx_data (/usr/lib/libpjsip.so.2+0x1933a)
>     #9 0x7f4df462c0dc in distribute res_pjsip/pjsip_distributor.c:348
>     #10 0x7c9a37 in ast_taskprocessor_execute /home/obs/asterisk-13.3.2/main/taskprocessor.c:769
>     #11 0x7d9a50 in threadpool_execute /home/obs/asterisk-13.3.2/main/threadpool.c:351
>     #12 0x7dce68 in worker_active /home/obs/asterisk-13.3.2/main/threadpool.c:1075
>     #13 0x7dca5c in worker_start /home/obs/asterisk-13.3.2/main/threadpool.c:995
>     #14 0x7f9646 in dummy_start /home/obs/asterisk-13.3.2/main/utils.c:1232
>     #15 0x31a3e079d0 in start_thread (/lib64/libpthread.so.0+0x31a3e079d0)
>     #16 0x31a36e88fc in clone (/lib64/libc.so.6+0x31a36e88fc)
> 0x61200016c594 is located 106790068334132 bytes inside
> {code}



--
This message was sent by Atlassian JIRA
(v6.2#6252)