[asterisk-bugs] [JIRA] (ASTERISK-29376) res_rtp_asterisk: Coredump with t.140 RED enabled

[Thomas Johnson (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-29376?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=254497#comment-254497 ] 

Thomas Johnson commented on ASTERISK-29376:
-------------------------------------------

With Asterisk 18.3, print *rtp on the core file gives this huge result:

$1 = {s = 275, f = {frametype = 0, subclass = {integer = 0, {format = 0x2257bf8, topology = 0x2257bf8}, frame_ending = 0}, datalen = 0, samples = 0, mallocd = 0,
    mallocd_hdr_len = 0, offset = 0, src = 0x0, data = {ptr = 0x0, uint32 = 0, pad = "\000\000\000\000\000\000\000"}, delivery = {tv_sec = 0, tv_usec = 0},
    frame_list = {next = 0x0}, flags = 0, ts = 0, len = 0, seqno = 0, stream_num = 0}, rawdata = '\000' <repeats 8255 times>, ssrc = 1640019621, ssrc_orig = 0,
  ssrc_saved = 0 '\000', cname = "740819dc-27b2-48ce-9d02-00e3b99287f3", themssrc = 0, themssrc_valid = 0, lastts = 0, lastividtimestamp = 0,
  lastovidtimestamp = 0, lastitexttimestamp = 0, lastotexttimestamp = 0, lastrxseqno = 0, expectedrxseqno = -1, missing_seqno = {elems = 0x0, max = 0,
    current = 0}, expectedseqno = -1, seedrxseqno = 0, seedrxts = 0, rxcount = 0, rxoctetcount = 0, txcount = 0, txoctetcount = 0, cycles = 0, rxjitter = 0,
  rxtransit = 0, lasttxformat = 0x2257bf8, lastrxformat = 0x2257bf8, resp = 0 '\000', last_seqno = 0, last_end_timestamp = 0, dtmf_duration = 0,
  dtmf_timeout = 0, dtmfsamples = 0, dtmfmode = AST_RTP_DTMF_MODE_NONE, lastdigitts = 0, sending_digit = 0 '\000', send_digit = 0 '\000', send_payload = 0,
  send_duration = 0, flags = 8, rxcore = {tv_sec = 0, tv_usec = 0}, txcore = {tv_sec = 0, tv_usec = 0}, drxcore = 0, dtmfmute = {tv_sec = 0, tv_usec = 0},
  smoother = 0x0, seqno = 28245, sched = 0x44a8c50, rtcp = 0x7fd1dc051260, asymmetric_codec = 0, bundled = 0x0, stream_num = -1, ssrc_mapping = {
    elems = 0x7fd1dc052600, max = 1, current = 0}, bind_address = {ss = {ss_family = 2, __ss_padding = "8x", '\000' <repeats 115 times>, __ss_align = 0},
    len = 16}, strict_rtp_state = STRICT_RTP_LEARN, strict_rtp_address = {ss = {ss_family = 0, __ss_padding = '\000' <repeats 117 times>, __ss_align = 0},
    len = 0}, rtp_source_learn = {proposed_address = {ss = {ss_family = 0, __ss_padding = '\000' <repeats 117 times>, __ss_align = 0}, len = 0}, start = {
      tv_sec = 1618251061, tv_usec = 606695}, received = {tv_sec = 0, tv_usec = 0}, max_seq = 0, packets = 4, stream_type = AST_MEDIA_TYPE_UNKNOWN}, red = 0x0,
  send_buffer = 0x0, recv_buffer = 0x0, transport_wide_cc = {packet_statistics = {elems = 0x0, max = 0, current = 0}, last_seqno = 0, last_extended_seqno = 0,
    feedback_count = 0, cycles = 0, schedid = -1}, cond = {__data = {{__wseq = 0, __wseq32 = {__low = 0, __high = 0}}, {__g1_start = 0, __g1_start32 = {
          __low = 0, __high = 0}}, __g_refs = {0, 0}, __g_size = {0, 0}, __g1_orig_size = 0, __wrefs = 0, __g_signals = {0, 0}},
    __size = '\000' <repeats 47 times>, __align = 0}, ice = 0x0, role = AST_RTP_ICE_ROLE_CONTROLLED, turn_rtp = 0x0, turn_rtcp = 0x0,
  turn_state = PJ_TURN_STATE_NULL, passthrough = 0, rtp_passthrough = 0, rtcp_passthrough = 0, ice_port = 14456, rtp_loop = {ss = {ss_family = 0,
      __ss_padding = '\000' <repeats 117 times>, __ss_align = 0}, len = 0}, rtcp_loop = {ss = {ss_family = 0, __ss_padding = '\000' <repeats 117 times>,
      __ss_align = 0}, len = 0}, ioqueue = 0x0, remote_ufrag = '\000' <repeats 255 times>, remote_passwd = '\000' <repeats 255 times>,
  local_ufrag = "3cd463d67157fc3d0b32fcf3055484e3", '\000' <repeats 223 times>, local_passwd = "2a99b3bb0c5b6e7050830b8d777e3432", '\000' <repeats 223 times>,
  ice_local_candidates = 0x7fd1dc0b24c0, ice_active_remote_candidates = 0x0, ice_proposed_remote_candidates = 0x0, ice_original_rtp_addr = {ss = {ss_family = 2,
      __ss_padding = "8x", '\000' <repeats 115 times>, __ss_align = 0}, len = 16}, ice_num_components = 2, ice_media_started = 0, ssl_ctx = 0x0,
  dtls_verify = AST_RTP_DTLS_VERIFY_NONE, suite = 0, local_hash = AST_RTP_DTLS_HASH_SHA256, local_fingerprint = '\000' <repeats 159 times>,
  remote_hash = AST_RTP_DTLS_HASH_SHA256, remote_fingerprint = '\000' <repeats 63 times>, rekey = 0, rekeyid = -1, dtls = {ssl = 0x0, read_bio = 0x0,
    write_bio = 0x0, dtls_setup = AST_RTP_DTLS_SETUP_ACTIVE, connection = AST_RTP_DTLS_CONNECTION_NEW, timeout_timer = -1}}

Core output was sent to the E-mail.


> res_rtp_asterisk: Coredump with t.140 RED enabled
> -------------------------------------------------
>
>                 Key: ASTERISK-29376
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-29376
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_asterisk
>    Affects Versions: 17.8.1
>         Environment: RedHat 8
>            Reporter: Thomas Johnson
>            Assignee: Thomas Johnson
>         Attachments: core.asterisk.2431.ipswitchdev66.microautomation.local.1617722782-brief.txt, core.asterisk.2431.ipswitchdev66.microautomation.local.1617722782-full.txt, core.asterisk.2431.ipswitchdev66.microautomation.local.1617722782-info.txt, core.asterisk.2431.ipswitchdev66.microautomation.local.1617722782-locks.txt, core.asterisk.2431.ipswitchdev66.microautomation.local.1617722782-thread1.txt
>
>
> Asterisk will randomly coredump if RED is allowed.  The exception is in an apparent scheduled callback to red_write.   I tried modifying the function to check for NULL pointers, but it still crashes due to possibly an invalid pointer.



--
This message was sent by Atlassian JIRA
(v6.2#6252)