[asterisk-bugs] [JIRA] (ASTERISK-27046) segfault res_pjsip_transport_websocket.c get_write_timeout

[Richard Mudgett (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-27046?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Mudgett updated ASTERISK-27046:
---------------------------------------

    Description: 
Segfault due to missing check for NULL return value when calling ast_sorcery_retrieve_by_id in function get_write_timeout.

Happens using Chromium 61, but not Firefox.. so depends on the client.
{noformat}
#0  get_write_timeout () at res_pjsip_transport_websocket.c:312
        __a = -1
        __b = <error reading variable __b (Cannot access memory at address 0x390)>
        transport = 0x0
        it_transport_states = {c = 0x7fc8f4001e18, last_node = 0x7fc8f4002290, complete = 0, flags = 0}
        transport_state = 0x1986a48
        write_timeout = -1
        transport_states = 0x7fc8f4001e18
#1  websocket_cb (session=0x7fc8f4013a08, parameters=<optimized out>, headers=<optimized out>) at res_pjsip_transport_websocket.c:349
        create_data = {transport = 0x7fc92dff4b00, ws_session = 0x1a91788}
        transport = <optimized out>
        read_data = {transport = 0x7fc8f4001e18, payload = 0x7fc8f4002290 "Hj\230\001", payload_len = 0}
        __PRETTY_FUNCTION__ = "websocket_cb"
{noformat}


  was:
Segfault due to missing check for NULL return value when calling ast_sorcery_retrieve_by_id in function get_write_timeout.

Happens using Chromium 61, but not Firefox.. so depends on the client.


#0  get_write_timeout () at res_pjsip_transport_websocket.c:312
        __a = -1
        __b = <error reading variable __b (Cannot access memory at address 0x390)>
        transport = 0x0
        it_transport_states = {c = 0x7fc8f4001e18, last_node = 0x7fc8f4002290, complete = 0, flags = 0}
        transport_state = 0x1986a48
        write_timeout = -1
        transport_states = 0x7fc8f4001e18
#1  websocket_cb (session=0x7fc8f4013a08, parameters=<optimized out>, headers=<optimized out>) at res_pjsip_transport_websocket.c:349
        create_data = {transport = 0x7fc92dff4b00, ws_session = 0x1a91788}
        transport = <optimized out>
        read_data = {transport = 0x7fc8f4001e18, payload = 0x7fc8f4002290 "Hj\230\001", payload_len = 0}
        __PRETTY_FUNCTION__ = "websocket_cb"



> segfault res_pjsip_transport_websocket.c get_write_timeout
> ----------------------------------------------------------
>
>                 Key: ASTERISK-27046
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27046
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_pjsip_transport_websocket
>    Affects Versions: 14.5.0
>         Environment: linux x64
>            Reporter: Jørgen H
>            Severity: Critical
>
> Segfault due to missing check for NULL return value when calling ast_sorcery_retrieve_by_id in function get_write_timeout.
> Happens using Chromium 61, but not Firefox.. so depends on the client.
> {noformat}
> #0  get_write_timeout () at res_pjsip_transport_websocket.c:312
>         __a = -1
>         __b = <error reading variable __b (Cannot access memory at address 0x390)>
>         transport = 0x0
>         it_transport_states = {c = 0x7fc8f4001e18, last_node = 0x7fc8f4002290, complete = 0, flags = 0}
>         transport_state = 0x1986a48
>         write_timeout = -1
>         transport_states = 0x7fc8f4001e18
> #1  websocket_cb (session=0x7fc8f4013a08, parameters=<optimized out>, headers=<optimized out>) at res_pjsip_transport_websocket.c:349
>         create_data = {transport = 0x7fc92dff4b00, ws_session = 0x1a91788}
>         transport = <optimized out>
>         read_data = {transport = 0x7fc8f4001e18, payload = 0x7fc8f4002290 "Hj\230\001", payload_len = 0}
>         __PRETTY_FUNCTION__ = "websocket_cb"
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)