[asterisk-dev] BOUNTY - ASTERISK-26978 - rtp: Crash in ast_rtp_codecs_payload_code()

[Ross Beer]

HI All,


I would like to offer a bounty to fix ASTERISK-26978<https://issues.asterisk.org/jira/browse/ASTERISK-26978>


Richard has kindly suggested a fix:


When the channels join the native rtp bridge the bridge technology needs to save a pointer with a ref to the rtp instance structure for both channels in the bridge. Then when a channel leaves the bridge the rtp instance's bridged with pointer can be guaranteed to be cleared. As it is now when a channel leaves the bridge there is no guarantee that the rtp instance's bridged with pointer gets cleared. Somehow both channel's rtp instance pointers are not being found so one of the rtp instance's bridged with pointer is not being cleared. As a result, the rtp code tries to natively bridge a frame to a destroyed rtp instance and deadlocks on a destroyed lock.


I am offering $1,000 for fixing the crash and deadlock.

Regards,

Ross


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20170524/24400b15/attachment.html>