Asterisk
  1. Asterisk
  2. ASTERISK-27382

crash after an invalid rtcp packet from GT48 FXS gateway

    Details

    • Type: Bug Bug
    • Status: Closed
    • Severity: Major Major
    • Resolution: Fixed
    • Affects Version/s: 13.13.1, 13.17.2
    • Target Release Version/s: 13.18.4, 13.19.0, 14.7.4, 15.1.4, 15.2.0, 16.0.0
    • Component/s: None
    • Security Level: None
    • Labels:
    • Environment:
      Centos 7
    • Frequency of Occurrence:
      Constant
    • Regression:
      Yes

      Description

      I get a fully reproducible crash in calls from a GreaTel GT48R FXS gateway. Whenever a call is long enough and has audio, it crashes.

      I used current git branch 13 (2e5e7e0b143c2fdbd852d98a5d356a3fe1c3bc43 , 2017-10-27). SIP configuration: added the following to sip.conf:

      [template](!)
      host = dynamic
      type = friend
      transport = udp
      secret=xxxxxx
      
      [558011](template)
      ; ditto for the other ports
      

      The following will not crash:

      channel originate SIP/558011 application Wait 50
      channel originate SIP/558011 application Playback beep
      

      The following does crash:

      channel originate SIP/558011 application Playback demo-instruct
      

      The shortest sound on the test system that seems to crash is sorry_didnt_get .

      Earlier versions of asterisk 13 did not crash from this. After bisecting, I found that branch 13 started crashing from this after applying commit b96f18560b529b614d0773a060bc03ef73498c61 astobj2: (Declare private variable data_size for AO2_DEBUG only.). Reverting that commit on branch 13 makes the crash go away, but I'm not yet sure how.

      Network traces seem to show that right at the end of the call (before the crash) the gateway sends an RTCP packet which seems to have (according to wireshark) odd values.

      1. 27382-traces.tgz
        1.08 MB
        Tzafrir Cohen
      2. AST-2017-012.txt
        5 kB
        Joshua C. Colp
      3. AST-2017-012-13.diff
        2 kB
        Joshua C. Colp
      4. core.7369-thread1.txt
        9 kB
        Tzafrir Cohen
      5. crash_2.cap
        100 kB
        Tzafrir Cohen
      6. crash.cap
        97 kB
        Tzafrir Cohen

        Issue Links

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

          Hide
          Friendly Automation added a comment -

          Change 7552 merged by George Joseph:
          AST-2017-012: Place single RTCP report block at beginning of report.

          https://gerrit.asterisk.org/7552

          Show
          Friendly Automation added a comment - Change 7552 merged by George Joseph: AST-2017-012: Place single RTCP report block at beginning of report. https://gerrit.asterisk.org/7552
          Hide
          Friendly Automation added a comment -

          Change 7551 merged by George Joseph:
          AST-2017-012: Place single RTCP report block at beginning of report.

          https://gerrit.asterisk.org/7551

          Show
          Friendly Automation added a comment - Change 7551 merged by George Joseph: AST-2017-012: Place single RTCP report block at beginning of report. https://gerrit.asterisk.org/7551
          Hide
          Friendly Automation added a comment -

          Change 7556 merged by George Joseph:
          AST-2017-012: Place single RTCP report block at beginning of report.

          https://gerrit.asterisk.org/7556

          Show
          Friendly Automation added a comment - Change 7556 merged by George Joseph: AST-2017-012: Place single RTCP report block at beginning of report. https://gerrit.asterisk.org/7556
          Hide
          Friendly Automation added a comment -

          Change 7557 merged by George Joseph:
          AST-2017-012: Place single RTCP report block at beginning of report.

          https://gerrit.asterisk.org/7557

          Show
          Friendly Automation added a comment - Change 7557 merged by George Joseph: AST-2017-012: Place single RTCP report block at beginning of report. https://gerrit.asterisk.org/7557
          Hide
          Friendly Automation added a comment -

          Change 7555 merged by George Joseph:
          AST-2017-012: Place single RTCP report block at beginning of report.

          https://gerrit.asterisk.org/7555

          Show
          Friendly Automation added a comment - Change 7555 merged by George Joseph: AST-2017-012: Place single RTCP report block at beginning of report. https://gerrit.asterisk.org/7555

            People

            • Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: