Re: PJSUA crash when trying to cancel outgoing call with pjsua_call_answer();

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


Hi Andreas,
i'm asking myself where to report bugs anyway.
You cannot push trac issues, neither the github repo allows you to create incidents !
This is a problem, especially when it comes to bugs and you hit one !

Line starting with 1763 is of special interest: 
You transaction is in progress so it leaved the function 
/* Can't terminate dialog because transaction is in progress.
    goto on_return;

But your program tries to pushback an uninitilaized list which then aborts on line 2638:
pj_list_push_back(&call->async_call.call_var.inc_call.answers, answer);

It's not clear to me why the code doesn't catch the goto line in the first place.
It would be great, if a core developer would respond anyway.


Von: pjsip <pjsip-bounces@xxxxxxxxxxxxxxx> im Auftrag von Andreas Wehrmann <a.wehrmann@xxxxxxxxxx>
Gesendet: Dienstag, 03. Dezember 2019 16:42
An: pjsip@xxxxxxxxxxxxxxx
Betreff:  PJSUA crash when trying to cancel outgoing call with pjsua_call_answer();

Hey folks,

By accident I found a (reproducible) crash in PJSUA.
So I found this because I was using the wrong PJSUA call for cancelling
an outgoing call.
The scenario is this:

- Initiate call with pjsua_call_make_call()
- Before the call is picked up; try to cancel the call with
pjsua_call_answer2() (and providing msg_data).

In this case, PJSUA always crashes with the following backtrace:

#0  0x0000000000571de0 in pj_list_insert_after (pos=0x7fffe0005608,
node=0x7fffe00088a8) at ../include/pj/list_i.h:33
#1  0x0000000000571e18 in pj_list_insert_before (pos=0x83fc28
<pjsua_var+68200>, node=0x7fffe00088a8) at ../include/pj/list_i.h:40
#2  0x00000000004581f7 in pj_list_push_back (list=0x83fc28
<pjsua_var+68200>, node=0x7fffe00088a8) at ../../pjlib/include/pj/list.h:128
#3  0x000000000045dad8 in pjsua_call_answer2 (call_id=1, opt=0x0,
code=603, reason=0x0, msg_data=0x7ffff0854870) at
#4  0x000000000042abaf in siss::UserAgent::answer (this=0x8c61c0,
cid=..., status_code=status_code@entry=603, reason=...,
additional_header=std::vector of length 0, capacity 0,
additional_payload=std::vector of length 0, capacity 0)
     at useragent.cpp:1071
#5  0x000000000042ae18 in siss::UserAgent::hangup (this=<optimized out>,
cid=..., status_code=status_code@entry=603, reason=...) at

Now before you get angry: Yes, I realize I need to use
pjsua_call_hangup() instead (and already confirmed it works that way);
But I would have expected the function to return with the appropiate
error code and not cause a hard crash.

Best Regards,
Andreas Wehrmann

Visit our blog:

pjsip mailing list

Visit our blog:

pjsip mailing list

[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux