[asterisk-bugs] [JIRA] (ASTERISK-29392) chan_iax2: Asterisk crashes when queueing video with format

[Friendly Automation (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-29392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=255675#comment-255675 ] 

Friendly Automation commented on ASTERISK-29392:
------------------------------------------------

Change 16205 merged by George Joseph:
AST-2021-008 - chan_iax2: remote crash on unsupported media format

[https://gerrit.asterisk.org/c/asterisk/+/16205|https://gerrit.asterisk.org/c/asterisk/+/16205]

> chan_iax2: Asterisk crashes when queueing video with format
> -----------------------------------------------------------
>
>                 Key: ASTERISK-29392
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-29392
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_iax2
>    Affects Versions: 16.2.1, 18.2.2, 18.3.0
>         Environment: FreePBX 15.0.17.24 - Intel Xeon plattform 64bit
>            Reporter: Michael Welk
>            Assignee: Kevin Harwell
>            Severity: Major
>              Labels: patch
>         Attachments: ASTERISK-29392.diff, Asterisk.dump, Asterisk-Session 2.zip, backtrace-old.txt, backtrace.txt, core.freepbx.sangoma.local-2021-04-15T08-45-01+0000-brief-old.txt, core.freepbx.sangoma.local-2021-04-15T08-45-01+0000-full-old.txt, core.freepbx.sangoma.local-2021-04-15T08-45-01+0000-info-old.txt, core.freepbx.sangoma.local-2021-04-15T08-45-01+0000-locks-old.txt, core.freepbx.sangoma.local-2021-04-15T08-45-01+0000-thread1-old.txt, core.freepbx.sangoma.local-2021-04-15T10-15-37+0000-brief.txt, core.freepbx.sangoma.local-2021-04-15T10-15-37+0000-full.txt, core.freepbx.sangoma.local-2021-04-15T10-15-37+0000-info.txt, core.freepbx.sangoma.local-2021-04-15T10-15-37+0000-locks.txt, core.freepbx.sangoma.local-2021-04-15T10-15-37+0000-thread1.txt
>
>
> Hello,
> i have connected 2 FreePBX Systems via Dundi/IAX2 trunk. Normal calls are working fine, but when i activate Video on the phone A (Cisco, Yaelink...) and call another phone B (phone A >Server A >IAX2> Server B> phone B) Server B crashes. When i stay with phone A+B on the same Server or disable Video on the phone - everything works perfect. This only happens via IAX2 trunks, sometimes immediatly, sometimes after a while during the call.
>  
> The configuration of the trunk is very basic
> dundi_custom.conf:
> {noformat}
> ; DK0MAV
> [22:e1:bc:08:83:5c]
> host=44.149.94.136
> include=priv
> model=symmetric
> order=primary
> permit=priv
> qualify=yes
> secret=xxxxxxxxx
> {noformat}
> iax_custom.conf:
> {noformat}
>  [iaxuser]
> type=friend
> dbsecret=dundi/secret
> context=incomingdundi
> {noformat} 
> I already disabled videosupport on the IAX-Trunk but still the same issue.
> Trace from the Asterisk-console of the crashing server:
> {noformat}
> Connected to Asterisk 16.2.1 currently running on freepbx (pid = 26623)
> – Accepting AUTHENTICATED call from 44.225.66.196:4569:
> – > requested format = g722,
> – > requested prefs = disabled,
> – > actual format = g722,
> – > host prefs = disabled,
> – > priority = disabled
> – Executing [315200612183 at incomingdundi:1] Playback("IAX2/iaxuser-5566", "custom/voip-dk0mav") in new stack
> – <IAX2/iaxuser-5566> Playing 'custom/voip-dk0mav.g722' (language 'en')
> [2021-04-12 21:49:48] WARNING[26669]: chan_iax2.c:11782 socket_process_helper: Received mini frame before first full video frame
> freepbx*CLI> <<<<<<<<<<<<<<<<crash>>>>>>>>>>>>>>>
> Disconnected from Asterisk server
> Asterisk cleanly ending (0).
> Executing last minute cleanups
> {noformat}
>  
> I have tried to downgrade to an older Asterisk version but no success.
> Just for clarification:
> I do not want video working via IAX-Trunks, that seems not possible for what reason ever. I just want that Asterisk do not crash when it receives a call from a phone that has video enabled via the trunk.
> The same configuration on earlier Asterisk versions (11, 13) is working without any problems.
> It seems Asterisk have a problem when frames are lost on the trunk and they arrive in a kind of wrong order. This leads to a crash.
> Maybe interesting but very old issue: https://www.coresecurity.com/core-labs/advisories/asterisk-pbx-truncated-video-frame-vulnerability
> Please help me.
> Best Regards
> Michael



--
This message was sent by Atlassian JIRA
(v6.2#6252)