| Summary: | ASTERISK-24369: res_pjsip: Large message on reliable transport can cause empty messages to be passed from the PJSIP stack up, causing crashes in multiple locations | ||
| Reporter: | Matt Jordan (mjordan) | Labels: | |
| Date Opened: | 2014-09-29 15:05:20 | Date Closed: | 2014-10-05 19:33:41 |
| Priority: | Major | Regression? | |
| Status: | Closed/Complete | Components: | Resources/res_hep_pjsip Resources/res_pjsip Resources/res_pjsip_logger |
| Versions: | 12.6.0 13.0.0-beta2 | Frequency of Occurrence | |
| Related Issues: | |||
| Environment: | Attachments: | ( 0) ASTERISK-24369-13-distributor.diff ( 1) ASTERISK-24369-13-hep.diff ( 2) ASTERISK-24369-13-logger.diff ( 3) ASTERISK-24369-bt.txt | |
| Description: | When a message that exceeds the {{PJ_MAX_PKT_SIZE}} is sent over a reliable transport, it is possible (although it shouldn't occur) for pjproject to pass up an {{rdata}} object with a NULL {{msg}} in the {{msg_info}}. Needless to say, things that attempt to dereference this are in for a rough ride.
In particular, this caused crashes in three different locations (primarily): # {{res_pjsip_logger}} # {{res_hep_pjsip}} # {{res_pjsip/distributor}} While pjproject should not be doing this, some defensive coding is probably warranted. In all cases, this is essentially an off nominal, and we should bail out as fast as possible. Backtrace and patches are attached. | ||
| Comments: | |||