[asterisk-bugs] [JIRA] (ASTERISK-26880) Asterisk crashes when multiple speex users join confbridge with pp_vad and dtx enabled

[Rusty Newton (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-26880?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rusty Newton updated ASTERISK-26880:
------------------------------------

    Description: 
I have compiled Asterisk 14.3.0 on a Fedora 25 Workstation. 

I have configured speex in asterisk to enable preprocessing and preprocessing voice activity detection. I have two sip clients (linphones) using speex. When the two sip clients join the same Confbridge asterisk crashes with a segmentation fault with the following output (after running asterisk -vvvg -c):
{noformat}
warning: The VAD has been replaced by a hack pending a complete rewrite
warning: The VAD has been replaced by a hack pending a complete rewrite
FRACK!, Failed assertion user_data is NULL (0) at line 5727 in ast_set_write_format of channel.c
[Mar 16 18:30:32] ERROR[31673][C-00000001]: channel.c:5727 ast_set_write_format: FRACK!, Failed assertion user_data is NULL (0)
    -- <CBAnn/3000-00000000;1> Playing 'confbridge-join.gsm' (language 'en')
Got 22 backtrace records
#0: [0x62966c] asterisk(__ast_assert_failed+0x8d) [0x62966c]
#1: [0x45ef3f] asterisk() [0x45ef3f]
#2: [0x45f816] asterisk(__ao2_ref+0x89) [0x45f816]
#3: [0x533d2c] asterisk(__ast_format_cap_append+0xa7) [0x533d2c]
#4: [0x4c3e96] asterisk(ast_set_write_format+0x70) [0x4c3e96]
#5: [0x4c29ae] asterisk(ast_write+0x10aa) [0x4c29ae]
#6: [0x48a0f5] asterisk() [0x48a0f5]
#7: [0x48a7ee] asterisk() [0x48a7ee]
#8: [0x48af54] asterisk(bridge_channel_internal_join+0x558) [0x48af54]
#9: [0x47039c] asterisk(ast_bridge_join+0x2c1) [0x47039c]
#10: [0x7f53456fa9b5] /usr/lib/asterisk/modules/app_confbridge.so(+0xb9b5) [0x7f53456fa9b5]
#11: [0x5a2952] asterisk(pbx_exec+0x119) [0x5a2952]
#12: [0x58ed5b] asterisk() [0x58ed5b]
#13: [0x592947] asterisk(ast_spawn_extension+0x50) [0x592947]
#14: [0x593580] asterisk() [0x593580]
#15: [0x594ca3] asterisk() [0x594ca3]
#16: [0x62663e] asterisk() [0x62663e]
Segmentation fault (core dumped)
{noformat}

This error is also caused when dtx is enabled in codecs.conf. 

When pp_vad and dtx is disabled in codecs.conf, asterisk will not crash.

Attached are the asterisk config files that were configured to produce the error and a screen grab of the asterisk console after crash.

  was:
I have compiled Asterisk 14.3.0 on a Fedora 25 Workstation. 

I have configured speex in asterisk to enable preprocessing and preprocessing voice activity detection. I have two sip clients (linphones) using speex. When the two sip clients join the same Confbridge asterisk crashes with a segmentation fault with the following output (after running asterisk -vvvg -c):

warning: The VAD has been replaced by a hack pending a complete rewrite
warning: The VAD has been replaced by a hack pending a complete rewrite
FRACK!, Failed assertion user_data is NULL (0) at line 5727 in ast_set_write_format of channel.c
[Mar 16 18:30:32] ERROR[31673][C-00000001]: channel.c:5727 ast_set_write_format: FRACK!, Failed assertion user_data is NULL (0)
    -- <CBAnn/3000-00000000;1> Playing 'confbridge-join.gsm' (language 'en')
Got 22 backtrace records
#0: [0x62966c] asterisk(__ast_assert_failed+0x8d) [0x62966c]
#1: [0x45ef3f] asterisk() [0x45ef3f]
#2: [0x45f816] asterisk(__ao2_ref+0x89) [0x45f816]
#3: [0x533d2c] asterisk(__ast_format_cap_append+0xa7) [0x533d2c]
#4: [0x4c3e96] asterisk(ast_set_write_format+0x70) [0x4c3e96]
#5: [0x4c29ae] asterisk(ast_write+0x10aa) [0x4c29ae]
#6: [0x48a0f5] asterisk() [0x48a0f5]
#7: [0x48a7ee] asterisk() [0x48a7ee]
#8: [0x48af54] asterisk(bridge_channel_internal_join+0x558) [0x48af54]
#9: [0x47039c] asterisk(ast_bridge_join+0x2c1) [0x47039c]
#10: [0x7f53456fa9b5] /usr/lib/asterisk/modules/app_confbridge.so(+0xb9b5) [0x7f53456fa9b5]
#11: [0x5a2952] asterisk(pbx_exec+0x119) [0x5a2952]
#12: [0x58ed5b] asterisk() [0x58ed5b]
#13: [0x592947] asterisk(ast_spawn_extension+0x50) [0x592947]
#14: [0x593580] asterisk() [0x593580]
#15: [0x594ca3] asterisk() [0x594ca3]
#16: [0x62663e] asterisk() [0x62663e]
Segmentation fault (core dumped)


This error is also caused when dtx is enabled in codecs.conf. 

When pp_vad and dtx is disabled in codecs.conf, asterisk will not crash.

Attached are the asterisk config files that were configured to produce the error and a screen grab of the asterisk console after crash.


> Asterisk crashes when multiple speex users join confbridge with pp_vad and dtx enabled
> --------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-26880
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26880
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 13.9.1, 14.3.0
>         Environment: Fedora 25
>            Reporter: Kirsty Tyerman
>         Attachments: codecs.conf, extensions.conf, Screenshot from 2017-03-16 16-43-50.png, sip.conf
>
>
> I have compiled Asterisk 14.3.0 on a Fedora 25 Workstation. 
> I have configured speex in asterisk to enable preprocessing and preprocessing voice activity detection. I have two sip clients (linphones) using speex. When the two sip clients join the same Confbridge asterisk crashes with a segmentation fault with the following output (after running asterisk -vvvg -c):
> {noformat}
> warning: The VAD has been replaced by a hack pending a complete rewrite
> warning: The VAD has been replaced by a hack pending a complete rewrite
> FRACK!, Failed assertion user_data is NULL (0) at line 5727 in ast_set_write_format of channel.c
> [Mar 16 18:30:32] ERROR[31673][C-00000001]: channel.c:5727 ast_set_write_format: FRACK!, Failed assertion user_data is NULL (0)
>     -- <CBAnn/3000-00000000;1> Playing 'confbridge-join.gsm' (language 'en')
> Got 22 backtrace records
> #0: [0x62966c] asterisk(__ast_assert_failed+0x8d) [0x62966c]
> #1: [0x45ef3f] asterisk() [0x45ef3f]
> #2: [0x45f816] asterisk(__ao2_ref+0x89) [0x45f816]
> #3: [0x533d2c] asterisk(__ast_format_cap_append+0xa7) [0x533d2c]
> #4: [0x4c3e96] asterisk(ast_set_write_format+0x70) [0x4c3e96]
> #5: [0x4c29ae] asterisk(ast_write+0x10aa) [0x4c29ae]
> #6: [0x48a0f5] asterisk() [0x48a0f5]
> #7: [0x48a7ee] asterisk() [0x48a7ee]
> #8: [0x48af54] asterisk(bridge_channel_internal_join+0x558) [0x48af54]
> #9: [0x47039c] asterisk(ast_bridge_join+0x2c1) [0x47039c]
> #10: [0x7f53456fa9b5] /usr/lib/asterisk/modules/app_confbridge.so(+0xb9b5) [0x7f53456fa9b5]
> #11: [0x5a2952] asterisk(pbx_exec+0x119) [0x5a2952]
> #12: [0x58ed5b] asterisk() [0x58ed5b]
> #13: [0x592947] asterisk(ast_spawn_extension+0x50) [0x592947]
> #14: [0x593580] asterisk() [0x593580]
> #15: [0x594ca3] asterisk() [0x594ca3]
> #16: [0x62663e] asterisk() [0x62663e]
> Segmentation fault (core dumped)
> {noformat}
> This error is also caused when dtx is enabled in codecs.conf. 
> When pp_vad and dtx is disabled in codecs.conf, asterisk will not crash.
> Attached are the asterisk config files that were configured to produce the error and a screen grab of the asterisk console after crash.



--
This message was sent by Atlassian JIRA
(v6.2#6252)