[asterisk-bugs] [JIRA] (ASTERISK-27230) PJSIP Destroyed timer being called causing segfault

[Ross Beer (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-27230?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ross Beer updated ASTERISK-27230:
---------------------------------

    Description: 
PJPROJECT segfaults when cancelling timer and reheaping.

{noformat}
Thread 1 (Thread 0x7fe2c6bdf700 (LWP 11308)):
#0  0x00007fe2cbf5d1b9 in copy_node (ht=0x20d4ee0, slot=312, moved_node=0x7fe25040b928) at ../src/pj/timer.c:137
No locals.
#1  0x00007fe2cbf5d5e9 in reheap_up (ht=0x20d4ee0, moved_node=0x7fe1802740c8, slot=312, parent=155) at ../src/pj/timer.c:208
No locals.
#2  0x00007fe2cbf5d7fc in remove_node (ht=0x20d4ee0, slot=312) at ../src/pj/timer.c:254
        parent = 155
        moved_node = 0x7fe1802740c8
        removed_node = 0x7fdfdc25ea98
#3  0x00007fe2cbf5daea in cancel (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=7) at ../src/pj/timer.c:353
        timer_node_slot = 312
#4  0x00007fe2cbf5e00e in cancel_timer (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=6, id_val=0) at ../src/pj/timer.c:594
        count = 32738
#5  0x00007fe2cbf5e0cd in pj_timer_heap_cancel_if_active (ht=0x20d4ee0, entry=0x7fdfdc25ea98, id_val=0) at ../src/pj/timer.c:618
No locals.
#6  0x00007fe2cbead7b6 in pjsip_endpt_cancel_timer (endpt=0x20d4bf8, entry=0x7fdfdc25ea98) at ../src/pjsip/sip_endpoint.c:814
No locals.
#7  0x00007fe2cbe92656 in stop_timer (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:535
No locals.
#8  0x00007fe2cbe93953 in pjsip_timer_end_session (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:1229
{noformat}

  was:
PJPROJECT segfaults when canceling timer and reheaping.

{noformat}
Thread 1 (Thread 0x7fe2c6bdf700 (LWP 11308)):
#0  0x00007fe2cbf5d1b9 in copy_node (ht=0x20d4ee0, slot=312, moved_node=0x7fe25040b928) at ../src/pj/timer.c:137
No locals.
#1  0x00007fe2cbf5d5e9 in reheap_up (ht=0x20d4ee0, moved_node=0x7fe1802740c8, slot=312, parent=155) at ../src/pj/timer.c:208
No locals.
#2  0x00007fe2cbf5d7fc in remove_node (ht=0x20d4ee0, slot=312) at ../src/pj/timer.c:254
        parent = 155
        moved_node = 0x7fe1802740c8
        removed_node = 0x7fdfdc25ea98
#3  0x00007fe2cbf5daea in cancel (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=7) at ../src/pj/timer.c:353
        timer_node_slot = 312
#4  0x00007fe2cbf5e00e in cancel_timer (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=6, id_val=0) at ../src/pj/timer.c:594
        count = 32738
#5  0x00007fe2cbf5e0cd in pj_timer_heap_cancel_if_active (ht=0x20d4ee0, entry=0x7fdfdc25ea98, id_val=0) at ../src/pj/timer.c:618
No locals.
#6  0x00007fe2cbead7b6 in pjsip_endpt_cancel_timer (endpt=0x20d4bf8, entry=0x7fdfdc25ea98) at ../src/pjsip/sip_endpoint.c:814
No locals.
#7  0x00007fe2cbe92656 in stop_timer (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:535
No locals.
#8  0x00007fe2cbe93953 in pjsip_timer_end_session (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:1229
{noformat}


> PJSIP Destroyed timer being called causing segfault
> ---------------------------------------------------
>
>                 Key: ASTERISK-27230
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27230
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_pjsip
>    Affects Versions: GIT
>         Environment: Fedora 23
>            Reporter: Ross Beer
>              Labels: pjsip
>         Attachments: core-asterisk-103311-Asterisk7-1504005395-thread1.txt, core-asterisk-119854-Asterisk6-1508764500-thread1.txt, core-asterisk-158440-Asterisk5-1504033325-thread1.txt, core-asterisk-172816-Asterisk7-1507310948-thread1.txt, core-asterisk-25632-1520508424-thread1.txt, core-asterisk-40920-Asterisk7-1507023780-thread1.txt, core-asterisk-46551-Asterisk7-1508841302-thread1.txt, core-asterisk-5713-1507134548-thread1.txt
>
>
> PJPROJECT segfaults when cancelling timer and reheaping.
> {noformat}
> Thread 1 (Thread 0x7fe2c6bdf700 (LWP 11308)):
> #0  0x00007fe2cbf5d1b9 in copy_node (ht=0x20d4ee0, slot=312, moved_node=0x7fe25040b928) at ../src/pj/timer.c:137
> No locals.
> #1  0x00007fe2cbf5d5e9 in reheap_up (ht=0x20d4ee0, moved_node=0x7fe1802740c8, slot=312, parent=155) at ../src/pj/timer.c:208
> No locals.
> #2  0x00007fe2cbf5d7fc in remove_node (ht=0x20d4ee0, slot=312) at ../src/pj/timer.c:254
>         parent = 155
>         moved_node = 0x7fe1802740c8
>         removed_node = 0x7fdfdc25ea98
> #3  0x00007fe2cbf5daea in cancel (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=7) at ../src/pj/timer.c:353
>         timer_node_slot = 312
> #4  0x00007fe2cbf5e00e in cancel_timer (ht=0x20d4ee0, entry=0x7fdfdc25ea98, flags=6, id_val=0) at ../src/pj/timer.c:594
>         count = 32738
> #5  0x00007fe2cbf5e0cd in pj_timer_heap_cancel_if_active (ht=0x20d4ee0, entry=0x7fdfdc25ea98, id_val=0) at ../src/pj/timer.c:618
> No locals.
> #6  0x00007fe2cbead7b6 in pjsip_endpt_cancel_timer (endpt=0x20d4bf8, entry=0x7fdfdc25ea98) at ../src/pjsip/sip_endpoint.c:814
> No locals.
> #7  0x00007fe2cbe92656 in stop_timer (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:535
> No locals.
> #8  0x00007fe2cbe93953 in pjsip_timer_end_session (inv=0x7fdfdc0d7d58) at ../src/pjsip-ua/sip_timer.c:1229
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)