Potential bug in on_rx_rtp(transport_udp.c)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




Benny Prijono wrote:
>
> The rtp_src_addr is registered to pj_ioqueue_recvfrom(), so it will be 
> filled up by the ioqueue when it calls on_rx_rtp() callback. So 
> theoretically in the callback the value is always valid.
>
> Unless if this is that ugly race condition thing, where attach() is 
> being called while a packet is being received... I recall you reported 
> a similar case Michael (http://trac.pjsip.org/repos/ticket/460).
>


Hi Benny,

That is actually what I was thinking. I have been trying to figure out 
if it is possible that transport_attach() in transport_udp.c is being 
called at the same time as an rtp/rtcp packet is arriving.

Basically, I am getting an assertion failure in on_rx_rtcp() in 
transport_udp.c, when it calls:

pj_sockaddr_print(&udp->rtcp_src_addr, ...);

This comes right after this call:

pj_memcpy(&udp->rem_rtcp_addr, &udp->rtcp_src_addr, ...);

When I debug the coredump, udp->rtcp_src_addr is all zero's (hence the 
assertion failure in pj_sockaddr_print), but udp->rem_rtcp_addr is a 
valid/correct address. I don't see how this could happen unless another 
thread is overwriting that memory location.

-- 
Michael Broughton, Advanis

Unintended Recipient & Unauthorized Use of E-Mail:
This message and attachments may contain confidential or privileged
information that is intended only for the named recipient of this
e-mail. Any unauthorized use or distribution is not permitted. If you
have received this e-mail in error, deleting the e-mail and notifying
the sender would be appreciated. Thank you.




[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux