[asterisk-users] Asterisk 16.16.1 crash upon receiving image 0 udptl t38 sdp

[Joshua C. Colp]

On Tue, Aug 23, 2022 at 12:30 PM Benoit Panizzon <benoit.panizzon at imp.ch>
wrote:

> Hi List
>
> I can reproduce Asterisk 16.16.1 segfaulting in this situation:
>
> Asterisk configured with Application "ReceiveFax".
>
> Incoming call with SDP:
>
> v=0
> o=prt-cbl-sbc1 1418830458 1418830459 IN IP4 157.161.X.X
> s=sip call
> c=IN IP4 157.161.X.X
> t=0 0
> m=audio 11828 RTP/AVP 9 8 101
> a=rtpmap:9 g722/8000
> a=rtpmap:8 pcma/8000
> a=rtpmap:101 telephone-event/8000
> a=fmtp:101 0-15
> a=sendrecv
> a=ptime:20
>
> Asterisk Answering to Invite with 200 OK + SDP
>
> v=0
> o=prt-cbl-sbc1 1418830458 1418830461 IN IP4 157.161.X.X
> s=sip call
> c=IN IP4 157.161.X.X
> t=0 0
> m=audio 11830 RTP/AVP 8 101
> a=rtpmap:8 PCMA/8000
> a=rtpmap:101 telephone-event/8000
> a=fmtp:101 0-16
> a=ptime:20
> a=maxptime:150
> a=sendrecv
>
> ReceiveFax invoking Re-Invite to t38:
>
> v=0
> o=prt-cbl-sbc1 1418830458 1418830462 IN IP4 157.161.X.X
> s=sip call
> c=IN IP4 157.161.X.X
> t=0 0
> m=image 11830 udptl t38
> a=sendrecv
> a=T38FaxVersion:0
> a=T38MaxBitRate:14400
> a=T38FaxRateManagement:transferredTCF
> a=T38FaxMaxDatagram:425
>
> Caller telling. I am unable to do t38 by setting image port to zero in
> 200 OK + SDP reply to T38 Invite:
>
> v=0
> o=prt-cbl-sbc1 1418830458 1418830460 IN IP4 157.161.10.229
> s=sip call
> c=IN IP4 157.161.10.254
> t=0 0
> m=image 0 udptl t38
> a=sendrecv
>
> I have found a Snom M9 and a Grandstream Phone behaving that way.
>
> Upon receiving that 200 OK + SDP Asterisk is segfaulting!
>
> Has anyone else observed said issue?
>

This was a security issue[1] which was solved.

[1] https://downloads.asterisk.org/pub/security/AST-2021-006.html

-- 
Joshua C. Colp
Asterisk Project Lead
Sangoma Technologies
Check us out at www.sangoma.com and www.asterisk.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20220823/2cebf63b/attachment.html>