Details

    • Type: Bug Bug
    • Status: Closed
    • Severity: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Target Release Version/s: None
    • Component/s: Channels/chan_sip/T.38
    • Labels:
      None
    • SVN Revision Number:
      236360
    • Mantis ID:
      16517
    • Regression:
      No

      Description

      I have been experimenting with T.38 fax reception via SIP. This results in an immediate crash. While I am able to capture a coredump, for whatever reason GDB and MDB do not appear to be able to give me a usable backtrace. However, Asterisk logs these message immediately before crashing:

      [Dec 26 21:06:25] – Executing [fax@standard-fax:2] ReceiveFAX("SIP/broadriver-00000000", "/var/spool/fax/1261861580.0.fax,debug") in new stack
      [Dec 26 21:06:25] NOTICE[23097]: channel.c:2933 __ast_read: Dropping incompatible voice frame on SIP/broadriver-00000000 of format slin since our native format has changed to 0x4 (ulaw)
      grant*CLI> [Dec 26 21:06:25] WARNING[23097]: udptl.c:766 calculate_far_max_ifp: (no tag): Cannot calculate far_max_ifp before far_max_datagram has been set.
      [Dec 26 21:06:25] WARNING[23097]: udptl.c:766 calculate_far_max_ifp: (no tag): Cannot calculate far_max_ifp before far_max_datagram has been set.

      Next I tried forcing the max datagram in sip.conf like this:

      [general]
      t38pt_udptl=yes,maxdatagram=400

      However, Asterisk still crashes with the same message.

      Out of curiosity, I modified main/udptl.c at line 764 in the function calculate_far_max_ifp() to force the far_max_datagram to 400:

      udptl->far_max_datagram = 400;

      Doing this prevents Asterisk from segfaulting.

      I wish I could share a backtrace, but so far I can't produce anything useful. I am willing to post the entire core dump if that would be helpful.

        Issue Links

          Activity

          Hide
          David Vossel added a comment -

          Sorry I had to mark this private. This is a security concern we are already aware of. A patch has already been made to resolve this and a new security release is in the works. We're hoping to get it out later this week.

          Show
          David Vossel added a comment - Sorry I had to mark this private. This is a security concern we are already aware of. A patch has already been made to resolve this and a new security release is in the works. We're hoping to get it out later this week.
          Hide
          Digium Subversion added a comment -

          Repository: asterisk
          Revision: 244443

          U trunk/channels/chan_sip.c
          U trunk/include/asterisk/udptl.h
          U trunk/main/udptl.c

          ------------------------------------------------------------------------
          r244443 | dvossel | 2010-02-02 16:27:24 -0600 (Tue, 02 Feb 2010) | 18 lines

          fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field

          AST-2010-001

          (closes issue ASTERISK-15457)
          Reported by: krn

          (closes issue ASTERISK-15538)
          Reported by: barthpbx

          (closes issue ASTERISK-15371)
          Reported by: bklang

          (closes issue ASTERISK-15343)
          Reported by: elsto

          ------------------------------------------------------------------------

          http://svn.digium.com/view/asterisk?view=rev&revision=244443

          Show
          Digium Subversion added a comment - Repository: asterisk Revision: 244443 U trunk/channels/chan_sip.c U trunk/include/asterisk/udptl.h U trunk/main/udptl.c ------------------------------------------------------------------------ r244443 | dvossel | 2010-02-02 16:27:24 -0600 (Tue, 02 Feb 2010) | 18 lines fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field AST-2010-001 (closes issue ASTERISK-15457 ) Reported by: krn (closes issue ASTERISK-15538 ) Reported by: barthpbx (closes issue ASTERISK-15371 ) Reported by: bklang (closes issue ASTERISK-15343 ) Reported by: elsto ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=244443
          Hide
          Digium Subversion added a comment -

          Repository: asterisk
          Revision: 244445

          _U branches/1.6.2/
          U branches/1.6.2/channels/chan_sip.c
          U branches/1.6.2/include/asterisk/udptl.h
          U branches/1.6.2/main/udptl.c

          ------------------------------------------------------------------------
          r244445 | dvossel | 2010-02-02 16:29:38 -0600 (Tue, 02 Feb 2010) | 23 lines

          Merged revisions 244443 via svnmerge from
          https://origsvn.digium.com/svn/asterisk/trunk

          ........
          r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines

          fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field

          AST-2010-001

          (closes issue ASTERISK-15457)
          Reported by: krn

          (closes issue ASTERISK-15538)
          Reported by: barthpbx

          (closes issue ASTERISK-15371)
          Reported by: bklang

          (closes issue ASTERISK-15343)
          Reported by: elsto
          ........

          ------------------------------------------------------------------------

          http://svn.digium.com/view/asterisk?view=rev&revision=244445

          Show
          Digium Subversion added a comment - Repository: asterisk Revision: 244445 _U branches/1.6.2/ U branches/1.6.2/channels/chan_sip.c U branches/1.6.2/include/asterisk/udptl.h U branches/1.6.2/main/udptl.c ------------------------------------------------------------------------ r244445 | dvossel | 2010-02-02 16:29:38 -0600 (Tue, 02 Feb 2010) | 23 lines Merged revisions 244443 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ........ r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field AST-2010-001 (closes issue ASTERISK-15457 ) Reported by: krn (closes issue ASTERISK-15538 ) Reported by: barthpbx (closes issue ASTERISK-15371 ) Reported by: bklang (closes issue ASTERISK-15343 ) Reported by: elsto ........ ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=244445
          Hide
          Digium Subversion added a comment -

          Repository: asterisk
          Revision: 244446

          _U branches/1.6.1/
          U branches/1.6.1/channels/chan_sip.c
          U branches/1.6.1/include/asterisk/udptl.h
          U branches/1.6.1/main/udptl.c

          ------------------------------------------------------------------------
          r244446 | dvossel | 2010-02-02 16:31:30 -0600 (Tue, 02 Feb 2010) | 23 lines

          Merged revisions 244443 via svnmerge from
          https://origsvn.digium.com/svn/asterisk/trunk

          ........
          r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines

          fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field

          AST-2010-001

          (closes issue ASTERISK-15457)
          Reported by: krn

          (closes issue ASTERISK-15538)
          Reported by: barthpbx

          (closes issue ASTERISK-15371)
          Reported by: bklang

          (closes issue ASTERISK-15343)
          Reported by: elsto
          ........

          ------------------------------------------------------------------------

          http://svn.digium.com/view/asterisk?view=rev&revision=244446

          Show
          Digium Subversion added a comment - Repository: asterisk Revision: 244446 _U branches/1.6.1/ U branches/1.6.1/channels/chan_sip.c U branches/1.6.1/include/asterisk/udptl.h U branches/1.6.1/main/udptl.c ------------------------------------------------------------------------ r244446 | dvossel | 2010-02-02 16:31:30 -0600 (Tue, 02 Feb 2010) | 23 lines Merged revisions 244443 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ........ r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field AST-2010-001 (closes issue ASTERISK-15457 ) Reported by: krn (closes issue ASTERISK-15538 ) Reported by: barthpbx (closes issue ASTERISK-15371 ) Reported by: bklang (closes issue ASTERISK-15343 ) Reported by: elsto ........ ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=244446
          Hide
          Digium Subversion added a comment -

          Repository: asterisk
          Revision: 244447

          _U branches/1.6.0/
          U branches/1.6.0/channels/chan_sip.c
          U branches/1.6.0/include/asterisk/udptl.h
          U branches/1.6.0/main/udptl.c

          ------------------------------------------------------------------------
          r244447 | dvossel | 2010-02-02 16:32:56 -0600 (Tue, 02 Feb 2010) | 23 lines

          Merged revisions 244443 via svnmerge from
          https://origsvn.digium.com/svn/asterisk/trunk

          ........
          r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines

          fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field

          AST-2010-001

          (closes issue ASTERISK-15457)
          Reported by: krn

          (closes issue ASTERISK-15538)
          Reported by: barthpbx

          (closes issue ASTERISK-15371)
          Reported by: bklang

          (closes issue ASTERISK-15343)
          Reported by: elsto
          ........

          ------------------------------------------------------------------------

          http://svn.digium.com/view/asterisk?view=rev&revision=244447

          Show
          Digium Subversion added a comment - Repository: asterisk Revision: 244447 _U branches/1.6.0/ U branches/1.6.0/channels/chan_sip.c U branches/1.6.0/include/asterisk/udptl.h U branches/1.6.0/main/udptl.c ------------------------------------------------------------------------ r244447 | dvossel | 2010-02-02 16:32:56 -0600 (Tue, 02 Feb 2010) | 23 lines Merged revisions 244443 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ........ r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field AST-2010-001 (closes issue ASTERISK-15457 ) Reported by: krn (closes issue ASTERISK-15538 ) Reported by: barthpbx (closes issue ASTERISK-15371 ) Reported by: bklang (closes issue ASTERISK-15343 ) Reported by: elsto ........ ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=244447

            People

            • Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development