[asterisk-bugs] [JIRA] (ASTERISK-28532) Segfault at res_rtp_multicast.c:211 (function set_type)

[Kevin Harwell (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-28532?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Kevin Harwell updated ASTERISK-28532:
-------------------------------------

    Description: 
Asterisk will crash with a segmention fault on sending a multicast rtp stream.

In res_rtp_multicast at line 289 (multicast_rtp_new) the void pointer data is cast to ast_multicast_rtp_options*, but in fact it should be a char*.

Backtrace:
{noformat}
Thread 3 "asterisk" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 9502.9717]
__strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
198	../sysdeps/x86_64/multiarch/strcmp-sse42.S: No such file or directory.
(gdb) bt
#0  __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
#1  0x00007fffb3284362 in set_type (multicast=<optimized out>, type=0x3332006369736162 <error: Cannot access memory at address 0x3332006369736162>) at res_rtp_multicast.c:211
#2  multicast_rtp_new (instance=0x7fffe4120bc0, sched=<optimized out>, addr=<optimized out>, data=0x7fff7ee5f380) at res_rtp_multicast.c:295
#3  0x00005555556bd7e5 in ast_rtp_instance_new (engine_name=engine_name at entry=0x7fff8bf547a0 "multicast", sched=sched at entry=0x0, sa=sa at entry=0x7fff7ee5f3d0, data=data at entry=0x7fff7ee5f380) at rtp_engine.c:468
#4  0x00007fff8bf54572 in multicast_rtp_request (type=<optimized out>, cap=<optimized out>, assignedids=0x0, requestor=0x7fffcc0a3510, data=<optimized out>, cause=0x7fff7ee5f704) at chan_multicast_rtp.c:156
#5  0x0000555555601823 in ast_request (type=0x7fffe417e3d8 "MulticastRTP", request_cap=request_cap at entry=0x7fffcc0188b8, assignedids=assignedids at entry=0x0, requestor=requestor at entry=0x7fffcc0a3510, addr=0x7fffe417e3f2 "basic/239.255.255.240:10001", cause=cause at entry=0x7fff7ee5f704) at channel.c:6274
#6  0x00007fff8747fa2d in dial_exec_full (chan=0x7fffcc0a3510, data=<optimized out>, peerflags=peerflags at entry=0x7fff7ee60290, continue_exec=continue_exec at entry=0x0) at app_dial.c:2521
{noformat}
Steps to reproduce, create a Lua dialplan extension with the following content:

~~~
{noformat}
extensions = {
    ['context'] ) {
        ['_150'] = function(context, extension)
            local snd = '/path/to/some/wavfile'
            app.dial('MulticastRTP/basic/239.255.255.240:'..tostring(port)..',60,tTwA('.. snd ..')'
        end;
    }
}
{noformat}
~~~

  was:
Asterisk will crash with a segmention fault on sending a multicast rtp stream.

In res_rtp_multicast at line 289 (multicast_rtp_new) the void pointer data is cast to ast_multicast_rtp_options*, but in fact it should be a char*.

Backtrace:

Thread 3 "asterisk" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 9502.9717]
__strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
198	../sysdeps/x86_64/multiarch/strcmp-sse42.S: No such file or directory.
(gdb) bt
#0  __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
#1  0x00007fffb3284362 in set_type (multicast=<optimized out>, type=0x3332006369736162 <error: Cannot access memory at address 0x3332006369736162>) at res_rtp_multicast.c:211
#2  multicast_rtp_new (instance=0x7fffe4120bc0, sched=<optimized out>, addr=<optimized out>, data=0x7fff7ee5f380) at res_rtp_multicast.c:295
#3  0x00005555556bd7e5 in ast_rtp_instance_new (engine_name=engine_name at entry=0x7fff8bf547a0 "multicast", sched=sched at entry=0x0, sa=sa at entry=0x7fff7ee5f3d0, data=data at entry=0x7fff7ee5f380) at rtp_engine.c:468
#4  0x00007fff8bf54572 in multicast_rtp_request (type=<optimized out>, cap=<optimized out>, assignedids=0x0, requestor=0x7fffcc0a3510, data=<optimized out>, cause=0x7fff7ee5f704) at chan_multicast_rtp.c:156
#5  0x0000555555601823 in ast_request (type=0x7fffe417e3d8 "MulticastRTP", request_cap=request_cap at entry=0x7fffcc0188b8, assignedids=assignedids at entry=0x0, requestor=requestor at entry=0x7fffcc0a3510, addr=0x7fffe417e3f2 "basic/239.255.255.240:10001", cause=cause at entry=0x7fff7ee5f704) at channel.c:6274
#6  0x00007fff8747fa2d in dial_exec_full (chan=0x7fffcc0a3510, data=<optimized out>, peerflags=peerflags at entry=0x7fff7ee60290, continue_exec=continue_exec at entry=0x0) at app_dial.c:2521

Steps to reproduce, create a Lua dialplan extension with the following content:

~~~
extensions = {
    ['context'] ) {
        ['_150'] = function(context, extension)
            local snd = '/path/to/some/wavfile'
            app.dial('MulticastRTP/basic/239.255.255.240:'..tostring(port)..',60,tTwA('.. snd ..')'
        end;
    }
}
~~~


> Segfault at res_rtp_multicast.c:211 (function set_type)
> -------------------------------------------------------
>
>                 Key: ASTERISK-28532
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28532
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_multicast
>    Affects Versions: 13.21.0
>         Environment: Ubuntu 18.04
>            Reporter: Martin Ledderboge
>
> Asterisk will crash with a segmention fault on sending a multicast rtp stream.
> In res_rtp_multicast at line 289 (multicast_rtp_new) the void pointer data is cast to ast_multicast_rtp_options*, but in fact it should be a char*.
> Backtrace:
> {noformat}
> Thread 3 "asterisk" received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 9502.9717]
> __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
> 198	../sysdeps/x86_64/multiarch/strcmp-sse42.S: No such file or directory.
> (gdb) bt
> #0  __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:198
> #1  0x00007fffb3284362 in set_type (multicast=<optimized out>, type=0x3332006369736162 <error: Cannot access memory at address 0x3332006369736162>) at res_rtp_multicast.c:211
> #2  multicast_rtp_new (instance=0x7fffe4120bc0, sched=<optimized out>, addr=<optimized out>, data=0x7fff7ee5f380) at res_rtp_multicast.c:295
> #3  0x00005555556bd7e5 in ast_rtp_instance_new (engine_name=engine_name at entry=0x7fff8bf547a0 "multicast", sched=sched at entry=0x0, sa=sa at entry=0x7fff7ee5f3d0, data=data at entry=0x7fff7ee5f380) at rtp_engine.c:468
> #4  0x00007fff8bf54572 in multicast_rtp_request (type=<optimized out>, cap=<optimized out>, assignedids=0x0, requestor=0x7fffcc0a3510, data=<optimized out>, cause=0x7fff7ee5f704) at chan_multicast_rtp.c:156
> #5  0x0000555555601823 in ast_request (type=0x7fffe417e3d8 "MulticastRTP", request_cap=request_cap at entry=0x7fffcc0188b8, assignedids=assignedids at entry=0x0, requestor=requestor at entry=0x7fffcc0a3510, addr=0x7fffe417e3f2 "basic/239.255.255.240:10001", cause=cause at entry=0x7fff7ee5f704) at channel.c:6274
> #6  0x00007fff8747fa2d in dial_exec_full (chan=0x7fffcc0a3510, data=<optimized out>, peerflags=peerflags at entry=0x7fff7ee60290, continue_exec=continue_exec at entry=0x0) at app_dial.c:2521
> {noformat}
> Steps to reproduce, create a Lua dialplan extension with the following content:
> ~~~
> {noformat}
> extensions = {
>     ['context'] ) {
>         ['_150'] = function(context, extension)
>             local snd = '/path/to/some/wavfile'
>             app.dial('MulticastRTP/basic/239.255.255.240:'..tostring(port)..',60,tTwA('.. snd ..')'
>         end;
>     }
> }
> {noformat}
> ~~~



--
This message was sent by Atlassian JIRA
(v6.2#6252)