<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://reviewboard.asterisk.org/r/2899/">https://reviewboard.asterisk.org/r/2899/</a>
</td>
</tr>
</table>
<br />
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('https://reviewboard.asterisk.org/static/rb/images/review_request_box_top_bg.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
<tr>
<td>
<div>Review request for Asterisk Developers and Joshua Colp.</div>
<div>By Mark Michelson.</div>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt;">Repository: </b>
Asterisk
</div>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">The SIP one-legged transfer test was causing a crash in the testsuite. After investigating, the crash started occurring because of a (legitimate) fix to stop an RTP instance ref leak. The fix of the leak exposed a problem where an RTP instance's bridged pointer was pointing to a destroyed RTP instance.
After debugging, the problem became apparent. In the one-legged transfer test, two channels were in a native RTP local bridge. A third channel then replaced one of the channels in the bridge. The operation to replace a channel consists first of adding the new channel into the bridge and then removing the channel that is being replaced. The issue arose because the native RTP bridge code assumed that when its leave() callback was called, that there would be at most two channels in the bridge. As such, it would grab the first and last channels in the list of bridge channels and set their RTP instance bridged pointers NULL. As it turns out, the first and last channels in the bridge channel list were the first channel and the new third channel. As such, the second channel's RTP instance bridged pointer was never set NULL. It was left pointing to the first channel's RTP instance. This meant that when the first channel was hung up, a crash would soon happen since the second channel's RTP instance bridged pointer was pointing to a destroyed RTP instance.
My initial fix was to change native RTP bridging to grab the first and second channels from the list of bridge channels instead of the first and last. Instead, I went with a more robust approach that instead uses the channel we know is leaving as a base. We then can find which channel the leaving channel was bridged to and stop native RTP bridging those two channels. This method will work no matter the order that channels are added to the bridge.
I also added a note to the ast_bridge_technology leave() callback to indicate that no assumptions should be made regarding the number of channels that are in the bridge.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">The SIP one-legged transfer test now passes as expected.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>/trunk/bridges/bridge_native_rtp.c <span style="color: grey">(400253)</span></li>
<li>/trunk/include/asterisk/bridge_technology.h <span style="color: grey">(400253)</span></li>
</ul>
<p><a href="https://reviewboard.asterisk.org/r/2899/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>