[asterisk-bugs] [JIRA] (ASTERISK-26880) Asterisk crashes when multiple speex users join confbridge with pp_vad and dtx enabled

[Sean Bright (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26880?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=235974#comment-235974 ] 

Sean Bright commented on ASTERISK-26880:
----------------------------------------

[~JensV], delay that, I was just able to reproduce. The key (for me) was to actually speak once the caller entered the bridge. Will take a look.

> Asterisk crashes when multiple speex users join confbridge with pp_vad and dtx enabled
> --------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-26880
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26880
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/Bridging
>    Affects Versions: 13.9.1, 14.3.0
>         Environment: Fedora 25
>            Reporter: Kirsty Tyerman
>            Assignee: Kirsty Tyerman
>         Attachments: backtrace_13.10.txt, backtrace-13.14-git.txt, backtrace_14.3.txt, backtrace.txt, codecs.conf, config-13.14-git.zip, debug_log_26880.txt, extensions.conf, Screenshot from 2017-03-16 16-43-50.png, sip.conf
>
>
> I have compiled Asterisk 14.3.0 on a Fedora 25 Workstation. 
> I have configured speex in asterisk to enable preprocessing and preprocessing voice activity detection. I have two sip clients (linphones) using speex. When the two sip clients join the same Confbridge asterisk crashes with a segmentation fault with the following output (after running asterisk -vvvg -c):
> {noformat}
> warning: The VAD has been replaced by a hack pending a complete rewrite
> warning: The VAD has been replaced by a hack pending a complete rewrite
> FRACK!, Failed assertion user_data is NULL (0) at line 5727 in ast_set_write_format of channel.c
> [Mar 16 18:30:32] ERROR[31673][C-00000001]: channel.c:5727 ast_set_write_format: FRACK!, Failed assertion user_data is NULL (0)
>     -- <CBAnn/3000-00000000;1> Playing 'confbridge-join.gsm' (language 'en')
> Got 22 backtrace records
> #0: [0x62966c] asterisk(__ast_assert_failed+0x8d) [0x62966c]
> #1: [0x45ef3f] asterisk() [0x45ef3f]
> #2: [0x45f816] asterisk(__ao2_ref+0x89) [0x45f816]
> #3: [0x533d2c] asterisk(__ast_format_cap_append+0xa7) [0x533d2c]
> #4: [0x4c3e96] asterisk(ast_set_write_format+0x70) [0x4c3e96]
> #5: [0x4c29ae] asterisk(ast_write+0x10aa) [0x4c29ae]
> #6: [0x48a0f5] asterisk() [0x48a0f5]
> #7: [0x48a7ee] asterisk() [0x48a7ee]
> #8: [0x48af54] asterisk(bridge_channel_internal_join+0x558) [0x48af54]
> #9: [0x47039c] asterisk(ast_bridge_join+0x2c1) [0x47039c]
> #10: [0x7f53456fa9b5] /usr/lib/asterisk/modules/app_confbridge.so(+0xb9b5) [0x7f53456fa9b5]
> #11: [0x5a2952] asterisk(pbx_exec+0x119) [0x5a2952]
> #12: [0x58ed5b] asterisk() [0x58ed5b]
> #13: [0x592947] asterisk(ast_spawn_extension+0x50) [0x592947]
> #14: [0x593580] asterisk() [0x593580]
> #15: [0x594ca3] asterisk() [0x594ca3]
> #16: [0x62663e] asterisk() [0x62663e]
> Segmentation fault (core dumped)
> {noformat}
> This error is also caused when dtx is enabled in codecs.conf. 
> When pp_vad and dtx is disabled in codecs.conf, asterisk will not crash.
> Attached are the asterisk config files that were configured to produce the error and a screen grab of the asterisk console after crash.
> *STEPS TO REPRODUCE*
> 1. dnf install asterisk-13.9.1
> 2. use configuration files supplied in attatchments
> 3. configure two sip phones using speex and register to the asterisk server using sip accounts in sip.conf (may have to change sip bindaddr)
> 4. dial each sip phone into confbridge 3000
> *UPDATE*
> Please see further attached items, including a backtrace and an asterisk log. I have compiled asterisk from the git repository (commit b05d2fda0c8b3473c3d6d7bd1cc0473e2728b744) with the debugging flags on to obtain the backtrace. 
> bridge_channel.c:2348, is the source of the problem. It is not handling AST_FRAM_VOICE in switch statement correctly. Asterisk is caused to crash due to format being NULL.
> Applying patch.txt to main/bridge_channel.c does not cause asterisk to crash when multiple speex users join a confbridge.



--
This message was sent by Atlassian JIRA
(v6.2#6252)