[asterisk-bugs] [JIRA] (ASTERISK-28532) Segfault at res_rtp_multicast.c:211 (function set_type)

[Martin Ledderboge (JIRA)]

Martin Ledderboge created ASTERISK-28532:
--------------------------------------------

             Summary: Segfault at res_rtp_multicast.c:211 (function set_type)
                 Key: ASTERISK-28532
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28532
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Resources/res_rtp_multicast
    Affects Versions: 13.21.0
         Environment: Ubuntu 18.04
            Reporter: Martin Ledderboge


Asterisk will crash with a segmention fault on sending a multicast rtp stream.

In res_rtp_multicast at line 289 (multicast_rtp_new) the void pointer data is cast to ast_multicast_rtp_options*, but in fact it should be a char*.

Backtrace:

Thread 3 "asterisk" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 9502.9717]
__strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
198	../sysdeps/x86_64/multiarch/strcmp-sse42.S: No such file or directory.
(gdb) bt
#0  __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
#1  0x00007fffb3284362 in set_type (multicast=<optimized out>, type=0x3332006369736162 <error: Cannot access memory at address 0x3332006369736162>) at res_rtp_multicast.c:211
#2  multicast_rtp_new (instance=0x7fffe4120bc0, sched=<optimized out>, addr=<optimized out>, data=0x7fff7ee5f380) at res_rtp_multicast.c:295
#3  0x00005555556bd7e5 in ast_rtp_instance_new (engine_name=engine_name at entry=0x7fff8bf547a0 "multicast", sched=sched at entry=0x0, sa=sa at entry=0x7fff7ee5f3d0, data=data at entry=0x7fff7ee5f380) at rtp_engine.c:468
#4  0x00007fff8bf54572 in multicast_rtp_request (type=<optimized out>, cap=<optimized out>, assignedids=0x0, requestor=0x7fffcc0a3510, data=<optimized out>, cause=0x7fff7ee5f704) at chan_multicast_rtp.c:156
#5  0x0000555555601823 in ast_request (type=0x7fffe417e3d8 "MulticastRTP", request_cap=request_cap at entry=0x7fffcc0188b8, assignedids=assignedids at entry=0x0, requestor=requestor at entry=0x7fffcc0a3510, addr=0x7fffe417e3f2 "basic/239.255.255.240:10001", cause=cause at entry=0x7fff7ee5f704) at channel.c:6274
#6  0x00007fff8747fa2d in dial_exec_full (chan=0x7fffcc0a3510, data=<optimized out>, peerflags=peerflags at entry=0x7fff7ee60290, continue_exec=continue_exec at entry=0x0) at app_dial.c:2521

Steps to reproduce, create a Lua dialplan extension with the following content:

~~~
extensions = {
    ['context'] ) {
        ['_150'] = function(context, extension)
            local snd = '/path/to/some/wavfile'
            app.dial('MulticastRTP/basic/239.255.255.240:'..tostring(port)..',60,tTwA('.. snd ..')'
        end;
    }
}
~~~



--
This message was sent by Atlassian JIRA
(v6.2#6252)