[asterisk-bugs] [JIRA] (ASTERISK-26978) rtp: Crash in ast_rtp_codecs_payload_code()

[Richard Mudgett (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26978?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=237138#comment-237138 ] 

Richard Mudgett commented on ASTERISK-26978:
--------------------------------------------

[~rossbeer] I've outlined what I think is needed to fix the issue on May 5 above.  When the channels join the native rtp bridge the bridge technology needs to save a pointer with a ref to the rtp instance structure for both channels in the bridge.  Then when a channel leaves the bridge the rtp instance's bridged with pointer can be guaranteed to be cleared.  As it is now when a channel leaves the bridge there is no guarantee that the rtp instance's bridged with pointer gets cleared.  Somehow both channel's rtp instance pointers are not being found so one of the rtp instance's bridged with pointer is not being cleared.  As a result, the rtp code tries to natively bridge a frame to a destroyed rtp instance and deadlocks on a destroyed lock.

> rtp: Crash in ast_rtp_codecs_payload_code()
> -------------------------------------------
>
>                 Key: ASTERISK-26978
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26978
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/RTP
>    Affects Versions: GIT
>         Environment: Fedora 23
>            Reporter: Ross Beer
>         Attachments: backtrace_20170502_clean.txt, backtrace_20170511_clean.txt, backtrace_20170515_clean.txt, backtrace_20170518_02_Clean.txt, backtrace_20170524_clean.txt
>
>
> A crash has been introduced in a recent GIT commit:
> [5561] rtp_engine.c: Fix deadlock potential copying RTP payload maps.
> Please see attached backtrace, if required I can provide an unredacted trace.



--
This message was sent by Atlassian JIRA
(v6.2#6252)