[asterisk-bugs] [JIRA] (ASTERISK-27382) crash after an invalid rtcp packet from GT48 FXS gateway

[Tzafrir Cohen (JIRA)]

Tzafrir Cohen created ASTERISK-27382:
----------------------------------------

             Summary: crash after an invalid rtcp packet from GT48 FXS gateway
                 Key: ASTERISK-27382
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27382
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
    Affects Versions: 13.17.2, 13.13.1
         Environment: Centos 7
            Reporter: Tzafrir Cohen


I get a fully reproducible crash in calls from a GreaTel GT48R FXS gateway. Whenever a call is long enough and has audio, it crashes.

I used current git branch 13 (2e5e7e0b143c2fdbd852d98a5d356a3fe1c3bc43 , 2017-10-27). SIP configuration: added the following to sip.conf:
{code}
[template](!)
host = dynamic
type = friend
transport = udp
secret=xxxxxx

[558011](template)
; ditto for the other ports
{code}

The following will not crash:
{code}
channel originate SIP/558011 application Wait 50
channel originate SIP/558011 application Playback beep
{code}
The following does crash:
{code}
channel originate SIP/558011 application Playback demo-instruct
{code}
The shortest sound on the test system that seems to crash is sorry_didnt_get .

Earlier versions of asterisk 13 did not crash from this. After bisecting, I found that branch 13 started crashing from this after applying commit b96f18560b529b614d0773a060bc03ef73498c61 astobj2: (Declare private variable data_size for AO2_DEBUG only.). Reverting that commit on branch 13 makes the crash go away, but I'm not yet sure how.

Network traces seem to show that right at the end of the call (before the crash) the gateway sends an RTCP packet which seems to have (according to wireshark) odd values.



--
This message was sent by Atlassian JIRA
(v6.2#6252)