bugThe eXtended osip library - Bugs: bug #21748, eXtl_udp.c: udp_tl_send_message...

 
 

bug #21748: eXtl_udp.c: udp_tl_send_message crash if no osip_transaction_t provided under circumstance

Submitted by:  None
Submitted on:  Fri 07 Dec 2007 08:08:48 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Aymeric MOIZARD <aymeric>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 09 Dec 2007 06:29:33 PM UTC, comment #2:

This bug was already fixed in the CVS.
tks

Aymeric MOIZARD <aymeric>
Project AdministratorIn charge of this item.
Fri 07 Dec 2007 08:12:14 PM UTC, comment #1:

Valgrind (please excuse the minor variance in numbers from 3.0.3 but I debugged before submitting):

==30078== Invalid read of size 1
==30078== at 0xC2EBF06: udp_tl_send_message (eXtl_udp.c:540)
==30078== by 0xC2DC68E: cb_snd_message (jcallback.c:199)
==30078== by 0xC2D6011: eXosip_call_send_ack (eXcall_api.c:457)
==30078== by 0xA7C4546: linphone_call_accepted (exevents.c:80)
==30078== by 0xA7C46C6: linphone_core_process_event (exevents.c:832)
==30078== by 0xA7C138C: linphone_core_iterate (linphonecore.c:956)
==30078== by 0x40A178: linphone_gnome_iterate (linphone.c:322)
==30078== by 0xA51570A: (within /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA514FD2: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA5182DC: (within /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA5185E9: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0x6E55882: gtk_main (in /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==30078== Address 0xA8 is not stack'd, malloc'd or (recently) free'd
==30078==
==30078== Process terminating with default action of signal 11 (SIGSEGV)
==30078== Access not within mapped region at address 0xA8
==30078== at 0xC2EBF06: udp_tl_send_message (eXtl_udp.c:540)
==30078== by 0xC2DC68E: cb_snd_message (jcallback.c:199)
==30078== by 0xC2D6011: eXosip_call_send_ack (eXcall_api.c:457)
==30078== by 0xA7C4546: linphone_call_accepted (exevents.c:80)
==30078== by 0xA7C46C6: linphone_core_process_event (exevents.c:832)
==30078== by 0xA7C138C: linphone_core_iterate (linphonecore.c:956)
==30078== by 0x40A178: linphone_gnome_iterate (linphone.c:322)
==30078== by 0xA51570A: (within /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA514FD2: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA5182DC: (within /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0xA5185E9: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.1400.1)
==30078== by 0x6E55882: gtk_main (in /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==30078==
==30078== ERROR SUMMARY: 144 errors from 39 contexts (suppressed: 47 from 2)
==30078== malloc/free: in use at exit: 2,741,480 bytes in 18,017 blocks.
==30078== malloc/free: 130,963 allocs, 112,946 frees, 33,803,482 bytes allocated.
==30078== For counts of detected errors, rerun with: -v
==30078== searching for pointers to 18,017 not-freed blocks.
==30078== checked 32,577,376 bytes.

Anonymous
Fri 07 Dec 2007 08:08:48 PM UTC, original submission:

I have no idea what happens here, but here's what crashes.

Also included is some valgrind output.

I've fixed it on my end by changing '} else {' to '} else if(tr) {' and adding an '} else { printf("wouldacrashed\n"); }' after, but I'm still not sure everything is working properly.

Incidentally I'm connecting to a half-set-up openser server which speaks with a half-set-up asterisk CVS server, so at this point I have no idea who's to blame for not working, but hopefully I have a chance of getting it running if things stop crashing! :p

Anyway, hope it helps. Now to the linphone bug tracker...

---

eXtl_udp.c +534:
else if(tr)
{

#ifndef MINISIZE
/* delete first SRV entry that is not reachable */
if (tr->record.name[0]!='\0' && tr->record.srventry[0].srv[0]!='\0')
{
memmove(&tr->record.srventry[0], &tr->record.srventry[1], 9*sizeof(osip_srv_entry_t));
memset(&tr->record.srventry[9], 0, sizeof(osip_srv_entry_t));
osip_free (message);
return 0; /* retry for next retransmission! */
}
#endif
/* SIP_NETWORK_ERROR; */
osip_free (message);
return -1;
} else {
fprintf(stderr, "No 'tr', would have crashed here.\n" );
}

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by aymeric (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 09 Dec 2007 06:29:33 PM UTCaymericStatusNone=>Fixed
      Assigned toNone=>aymeric
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1