Re: [Linphone-developers] linphone remote crash

[Simon Morlat]

Thanks for the useful report. I'm fixing it right now.

Simon

Le mardi 14 septembre 2010 à 12:24 +0200, John Wimer a écrit :
> Hello,
> 
> I've discovered a crash in linphone when receiving malformed SDP.
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff46e3af8 in *__GI___strcasecmp (s1=0x732f00 "MP4V-ES", s2=0x0)
>      at strcasecmp.c:65
> 65    strcasecmp.c: No such file or directory.
>      in strcasecmp.c
> (gdb) bt
> #0  0x00007ffff46e3af8 in *__GI___strcasecmp (s1=0x732f00 "MP4V-ES", s2=0x0)
>      at strcasecmp.c:65
> #1  0x00007ffff774ffe4 in find_payload_type_best_match (local=0x8074a0,
>      remote=<value optimized out>, reading_response=<value optimized out>)
>      at offeranswer.c:33
> #2  match_payloads (local=0x8074a0, remote=<value optimized out>,
>      reading_response=<value optimized out>) at offeranswer.c:62
> #3  0x00007ffff77505ad in initiate_outgoing (
>      local_offer=<value optimized out>, remote_answer=<value optimized 
> out>,
>      result=0x91cf60) at offeranswer.c:120
> #4  offer_answer_initiate_outgoing (local_offer=<value optimized out>,
>      remote_answer=<value optimized out>, result=0x91cf60) at 
> offeranswer.c:173
> #5  0x00007ffff7754309 in call_accepted (sal=0x7fffdc00a0e0)
>      at sal_eXosip2.c:897
> #6  process_event (sal=0x7fffdc00a0e0) at sal_eXosip2.c:1468
> #7  sal_iterate (sal=0x7fffdc00a0e0) at sal_eXosip2.c:1589
> #8  0x00007ffff774d87a in linphone_core_iterate (lc=0x6cbc00)
>      at linphonecore.c:1649
> #9  0x000000000041054f in linphone_gtk_iterate (lc=0x6cbc00) at main.c:504
> #10 0x00007ffff4c3c09b in ?? () from /lib/libglib-2.0.so.0
> #11 0x00007ffff4c3b8c2 in g_main_context_dispatch () from 
> /lib/libglib-2.0.so.0
> #12 0x00007ffff4c3f748 in ?? () from /lib/libglib-2.0.so.0
> #13 0x00007ffff4c3fc55 in g_main_loop_run () from /lib/libglib-2.0.so.0
> 
> The SIP response leading to this crash:
> ========================
> SIP/2.0 200 OK
> Via: SIP/2.0/UDP 192.168.1.221:5060;rport=5060;branch=z9hG4bK2135124807
> From: <sip:address@hidden>;tag=157898417
> To: <sip:address@hidden:5070>;tag=1000586129
> Call-ID: 550574247
> CSeq: 20 INVITE
> Contact: <sip:address@hidden:5070>
> Content-Type: application/sdp
> User-Agent: eXosip/3.3.0
> Content-Length:   316
> 
> v=0
> o=- 123456 654321 IN IP4 192.168.1.221
> s=VoD
> c=IN IP4 192.168.1.221
> t=0 0
> a=range:ntp=0-387.929596
> m=video 7078/1 RTP/AVP 96
> a=rtpmap:97 mpeg4-generic/90000
> a=fmtp:97 
> streamtype=5;profile-level-id=1;mode=AAC-hbr;sizeLength=13;indexLength=3;indexDeltaLength=3;
>  
> config=139056E5A0;
> m=audio 7078/0 RTP/AVP
> ========================
> 
> I obviously need to fix the endpoint that's sending the malformed SDP, 
> but I wanted to inform you of the crash. I'm pretty sure linphone should 
> never be allowed to crash based on data sent from the remote peer.
> 
> John Wimer
> 
> _______________________________________________
> Linphone-developers mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/linphone-developers