Potential bug in on_rx_rtp(transport_udp.c)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Recently I found a potential bug in PJSIP.

//=============================================
static void on_rx_rtp( pj_ioqueue_key_t *key,
                       pj_ioqueue_op_key_t *op_key,
                       pj_ssize_t bytes_read)
{
    /* See if source address of RTP packet is different than the
     * configured address, and switch RTP remote address to
     * source packet address after several consecutive packets
     * have been received.
     */
    if (bytes_read>0 &&
        (udp->options & PJMEDIA_UDP_NO_SRC_ADDR_CHECKING)==0)
    {
          // BUG
    }
}
//=============================================

In the branch I marked "BUG",  the code access the "udp->rtp_src_addr", and
this runs in the thread created by "pjmedia_endpt_create".

But the rtcp_src_addr might be reset to all "0" in main event process
thread.  Which would then cause an assert fail.
(I can find the excat place where rtp_src_addr of a transport is modified.)

A trivial walk aroud is use PJMEDIA_UDP_NO_SRC_ADDR_CHECKING when create
this transport,  which would skip the whole branch.

-- 
look to the things around you,the immediate world around you, if you are
alive,it will mean something to you ??Paul Strand
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.pjsip.org/pipermail/pjsip_lists.pjsip.org/attachments/20090511/5e2d00f6/attachment.html>


[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux