[asterisk-bugs] [JIRA] (ASTERISK-27382) crash after an invalid rtcp packet from GT48 FXS gateway

[George Joseph (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-27382?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

George Joseph updated ASTERISK-27382:
-------------------------------------

    Security: None  (was: Reporter, Bug Marshals, and Digium)

> crash after an invalid rtcp packet from GT48 FXS gateway
> --------------------------------------------------------
>
>                 Key: ASTERISK-27382
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27382
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 13.13.1, 13.17.2
>         Environment: Centos 7
>            Reporter: Tzafrir Cohen
>            Assignee: Joshua Colp
>         Attachments: 27382-traces.tgz, AST-2017-012-13.diff, AST-2017-012.txt, core.7369-thread1.txt, crash_2.cap, crash.cap
>
>
> I get a fully reproducible crash in calls from a GreaTel GT48R FXS gateway. Whenever a call is long enough and has audio, it crashes.
> I used current git branch 13 (2e5e7e0b143c2fdbd852d98a5d356a3fe1c3bc43 , 2017-10-27). SIP configuration: added the following to sip.conf:
> {code}
> [template](!)
> host = dynamic
> type = friend
> transport = udp
> secret=xxxxxx
> [558011](template)
> ; ditto for the other ports
> {code}
> The following will not crash:
> {code}
> channel originate SIP/558011 application Wait 50
> channel originate SIP/558011 application Playback beep
> {code}
> The following does crash:
> {code}
> channel originate SIP/558011 application Playback demo-instruct
> {code}
> The shortest sound on the test system that seems to crash is sorry_didnt_get .
> Earlier versions of asterisk 13 did not crash from this. After bisecting, I found that branch 13 started crashing from this after applying commit b96f18560b529b614d0773a060bc03ef73498c61 astobj2: (Declare private variable data_size for AO2_DEBUG only.). Reverting that commit on branch 13 makes the crash go away, but I'm not yet sure how.
> Network traces seem to show that right at the end of the call (before the crash) the gateway sends an RTCP packet which seems to have (according to wireshark) odd values.



--
This message was sent by Atlassian JIRA
(v6.2#6252)