[asterisk-bugs] [JIRA] (ASTERISK-26926) func_speex: Crash caused by frame with no datalen

[Rusty Newton (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26926?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=236475#comment-236475 ] 

Rusty Newton commented on ASTERISK-26926:
-----------------------------------------

[~kenner] Thanks for the report. If you have access to the a full backtrace, please go ahead and throw it up on here as it helps others when they are searching or looking into the issue.

Also if you want to push a patch into Gerrit to speed things a long..

https://wiki.asterisk.org/wiki/display/AST/Gerrit+Usage

Thanks!

> func_speex: Crash caused by frame with no datalen
> -------------------------------------------------
>
>                 Key: ASTERISK-26926
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26926
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Functions/func_speex
>    Affects Versions: 14.3.0
>         Environment: Siren14 (and likely Siren7)
>            Reporter: Richard Kenner
>            Severity: Minor
>
> There is a crash in preprocess_analysis (st=0x2ac0740fd750, x=0x3cab9378) at preprocess.c:626 due to a frame being passed to func_speex.c looking like:  
> {noformat}
> (gdb) print *frame
> $1 = {frametype = AST_FRAME_VOICE, subclass = {integer = 0, 
>     format = 0xe2f9e20, frame_ending = 0}, datalen = 0, samples = 640, 
>   mallocd = 1, mallocd_hdr_len = 232, offset = 64, 
>   src = 0x2ac07413e7f8 "siren14tolin32", data = {ptr = 0x3cab9378, 
>     uint32 = 1017877368, pad = "x\223\253<\000\000\000"}, delivery = {
>     tv_sec = 1491485582, tv_usec = 407272}, frame_list = {next = 0x0}, 
>   flags = 0, ts = 0, len = 0, seqno = 0}
> {noformat}
> A check for  datalen != 0 is missing before the call to speex_preprocess around line 188 of func_speex.c.
> This was most recently seen with Siren14, but I believe also occurs less often with Siren7.



--
This message was sent by Atlassian JIRA
(v6.2#6252)