Custom Query (2195 matches)

There is a bug in pj_generate_unique_string() from guid_android.c which lead to overflow/leak with this error:

JNI ERROR (app bug): local reference table overflow (max=512)
local reference table dump:
  Last 10 entries (of 512):
      511: 0x12ec2f80 java.util.UUID
      510: 0x6fc02f38 java.lang.Class<java.util.UUID>
      509: 0x130a7e20 java.lang.String "4cb26510-cdfb-4a... (36 chars)
      508: 0x12ec2f40 java.util.UUID
      507: 0x6fc02f38 java.lang.Class<java.util.UUID>
      506: 0x12fcdd00 java.lang.String "22383c0c-14e7-46... (36 chars)
      505: 0x12ec2e80 java.util.UUID
      504: 0x6fc02f38 java.lang.Class<java.util.UUID>
      503: 0x12fcd880 java.lang.String "9f6a1bfc-06b4-46... (36 chars)
      502: 0x12ec2e40 java.util.UUID
  Summary:
      170 of java.lang.Class (1 unique instances)
      169 of java.lang.String (169 unique instances)
        1 of byte[] (533 elements)
        1 of byte[] (753 elements)
        1 of byte[] (1217 elements)
      170 of java.util.UUID (170 unique instances)

This error will be raised after multiple calls to pj_generate_unique_string().

Thanks to Esed Alihodzic for the report and patch.

Since #1961 pjsip use ANDROID_ALARM_GET_TIME for timestamp. However NDK r14 no longer support this by removing android_alarm.h. This patch will detect the android_alarm.h, and if it wasn't found ,timestamp will use CLOCK_BOOTTIME instead.

There is a possible issue in the sip_timer.c::timer_cb(), more specifically, in the last log call made in that method.

This since the dialog that corresponds to the pjsip_inv_session object is unlocked, and the dialog may be destroyed in the consecutive call to pjsip_inv_send_msg(). Since the invite session object’s memory pool simply points to the dialog’s memory pool (and the invite session object itself is allocated from the same pool), this memory may thereby already have been freed once the log call is executed.

The issue was encountered when testing the session expiration timeout: after a call has been established from A to B, B’s network connection is cut, and the session expiration timeout is awaited. Once the timer timeouts, the case above seems to occur.

Thanks to Christoffer Lauri and Fredrik Hansson for the report.