Re: Pjsip crashed on incoming/outgoing call since 2.7

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Christian,

As you suggested I built pjsip 2.7.2 with Address Sanitizer and then run example. Here is output:

=================================================================

==20494==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffcd7905c10 at pc 0x7ff28ee08bec bp 0x7ffcd79053f0 sp 0x7ffcd7904b98

WRITE of size 2280 at 0x7ffcd7905c10 thread T0

#0 0x7ff28ee08beb in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cbeb)

#1 0x421434 in pj_bzero (/home/milodev/projects/simplepjsua/simplepjsua+0x421434)

#2 0x4299b3 in pjsua_call_get_info (/home/milodev/projects/simplepjsua/simplepjsua+0x4299b3)

#3 0x4070c3 in on_call_state /home/milodev/projects/simplepjsua/main.cpp:80

#4 0x435f09 in pjsua_call_on_state_changed (/home/milodev/projects/simplepjsua/simplepjsua+0x435f09)

#5 0x51875b in inv_set_state (/home/milodev/projects/simplepjsua/simplepjsua+0x51875b)

#6 0x529677 in inv_on_state_null (/home/milodev/projects/simplepjsua/simplepjsua+0x529677)

#7 0x51a3d3 in mod_inv_on_tsx_state (/home/milodev/projects/simplepjsua/simplepjsua+0x51a3d3)

#8 0x50bdb1 in pjsip_dlg_on_tsx_state (/home/milodev/projects/simplepjsua/simplepjsua+0x50bdb1)

#9 0x50d170 in mod_ua_on_tsx_state (/home/milodev/projects/simplepjsua/simplepjsua+0x50d170)

#10 0x4f636d in tsx_set_state (/home/milodev/projects/simplepjsua/simplepjsua+0x4f636d)

#11 0x4fc62b in tsx_on_state_null (/home/milodev/projects/simplepjsua/simplepjsua+0x4fc62b)

#12 0x4f8c26 in pjsip_tsx_send_msg (/home/milodev/projects/simplepjsua/simplepjsua+0x4f8c26)

#13 0x5079a2 in pjsip_dlg_send_request (/home/milodev/projects/simplepjsua/simplepjsua+0x5079a2)

#14 0x5261fa in pjsip_inv_send_msg (/home/milodev/projects/simplepjsua/simplepjsua+0x5261fa)

#15 0x423513 in on_make_call_med_tp_complete (/home/milodev/projects/simplepjsua/simplepjsua+0x423513)

#16 0x424c2c in pjsua_call_make_call (/home/milodev/projects/simplepjsua/simplepjsua+0x424c2c)

#17 0x4076f2 in main /home/milodev/projects/simplepjsua/main.cpp:190

#18 0x7ff28d02d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

#19 0x406f08 in _start (/home/milodev/projects/simplepjsua/simplepjsua+0x406f08)


Address 0x7ffcd7905c10 is located in stack of thread T0 at offset 0 in frame

#0 0x43521b in pjsua_call_on_state_changed (/home/milodev/projects/simplepjsua/simplepjsua+0x43521b)


This frame has 1 object(s):

[32, 40) 'tdata' <== Memory access at offset 0 partially underflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext

(longjmp and C++ exceptions *are* supported)

SUMMARY: AddressSanitizer: stack-buffer-underflow ??:0 __asan_memset

Shadow bytes around the buggy address:

0x10001af18b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x10001af18b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x10001af18b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x10001af18b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x10001af18b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x10001af18b80: 00 00[f1]f1 f1 f1 00 f4 f4 f4 f3 f3 f3 f3 00 00

0x10001af18b90: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1

0x10001af18ba0: 00 f4 f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00

0x10001af18bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x10001af18bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1

0x10001af18bd0: f1 f1 00 00 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00

Partially addressable: 01 02 03 04 05 06 07

Heap left redzone: fa

Heap right redzone: fb

Freed heap region: fd

Stack left redzone: f1

Stack mid redzone: f2

Stack right redzone: f3

Stack partial redzone: f4

Stack after return: f5

Stack use after scope: f8

Global redzone: f9

Global init order: f6

Poisoned by user: f7

Container overflow: fc

Array cookie: ac

Intra object redzone: bb

ASan internal: fe

==20494==ABORTING



I also made check with Valgrind, but it did't show any error, though.


2018-05-28 15:13 GMT+02:00 Christian Hoff <Christian_Hoff@xxxxxxx>:
Hello Jan,
 
sure, the example is up to date.
 
But I also had crashes when running this sample application. However these crashes were not due to bugs in the example itself, but due to problems inside PJSIP.
 
You should try to run the PJSUA app with Valgrind or to compile PJSIP with Address Sanitizer and see if these tools report any illegal memory access. This will help to nail the problem down. From your error message ("stack smashing detected") it is impossible to deduce the root cause of the problem.
 
 
Kind regards,
 
   Christian
 
Gesendet: Montag, 28. Mai 2018 um 13:58 Uhr
Von: "Jan Skórczyński" <jskorczynski@milosolutions.com>
An: pjsip@xxxxxxxxxxxxxxx
Betreff:  Pjsip crashed on incoming/outgoing call since 2.7
Hello,
 
Recently I run this: http://www.pjsip.org/pjsip/docs/html/page_pjsip_sample_simple_pjsuaua_c.htm example on my linux machine. The only thing I changed was server address (my own opensips instance with mediaproxy support). Unfortunately it crashed right after making a call with error:
 
*** stack smashing detected ***
 
What's interesting when using pjsip 2.6 everything works fine. Crash occurs on version 2.7 and above (I tried 2.7, 2.7.1, 2.7.2). 
I checked my opensips configuration and it looks ok, everything works with 2.6 (I can make calls etc.)
 
Can anyone tell me what has been changed in 2.7 and above? Do I need to change the way I'm making calls? Is "simple_pjsua" example up to date?
 
Thanks in advance
 
_______________________________________________ Visit our blog: http://blog.pjsip.org pjsip mailing list pjsip@xxxxxxxxxxxxxxx http://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org

_______________________________________________
Visit our blog: http://blog.pjsip.org

pjsip mailing list
pjsip@xxxxxxxxxxxxxxx
http://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org




_______________________________________________
Visit our blog: http://blog.pjsip.org

pjsip mailing list
pjsip@xxxxxxxxxxxxxxx
http://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org

[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux