Custom Query (2195 matches)

From srtp doc (srtp.h)

/**
 * SRTP_MAX_TRAILER_LEN is the maximum length of the SRTP trailer
 * (authentication tag and MKI) supported by libSRTP.  This value is
 * the maixmum number of octets that will be added to an RTP packet by
 * srtp_protect().
 *
 * @brief the maximum number of octets added by srtp_protect().
 */
#define SRTP_MAX_TRAILER_LEN (SRTP_MAX_TAG_LEN + SRTP_MAX_MKI_LEN)

...
 * @warning This function assumes that it can write SRTP_MAX_TRAILER_LEN 
 * into the location in memory immediately following the RTP packet.   
 * Callers MUST ensure that this much writable memory is available in 
 * the buffer that holds the RTP packet.
...
srtp_err_status_t srtp_protect(srtp_t ctx, void *rtp_hdr, int *len_ptr);

Currently, transport SRTP use hardcoded value to check if the space is sufficient.

This ticket will use SRTP_MAX_TRAILER_LEN instead to check the required buffer space.

Thanks to Chris Panayis for the report.

Some endpoints put extra newlines in the SDP body, which would otherwise cause parsing error.

Export the following internal macros so that they are overridable from config_site.h:

• PJSIP_PRES_DEFAULT_EXPIRES (was PRES_DEFAULT_EXPIRES):
  Specify the default expiration time for presence event subscription, for both client and server subscription. For client subscription, application can override this by specifying positive non-zero value in "expires" parameter when calling #pjsip_pres_initiate(). For server subscription, we would take the expiration value from the Expires header sent by client in the SUBSCRIBE request if the header exists and its value is less than this setting, otherwise this setting will be used.
• PJSIP_EVSUB_TIME_UAC_REFRESH (was TIME_UAC_REFRESH):
  Specify the time (in seconds) to send SUBSCRIBE to refresh client subscription before the actual interval expires.
• PJSIP_EVSUB_TIME_UAC_TERMINATE (was TIME_UAC_TERMINATE):
  Specify the time (in seconds) to wait for the final NOTIFY from the server after client has sent un-SUBSCRIBE request.
• PJSIP_EVSUB_TIME_UAC_WAIT_NOTIFY (was TIME_UAC_WAIT_NOTIFY):
  Specify the time (in seconds) for client subscription to wait for another NOTIFY from the server, if it has rejected the last NOTIFY with non-2xx final response (such as 401). If further NOTIFY is not received within this period, the client will unsubscribe.
• PJSIP_PUBLISHC_DELAY_BEFORE_REFRESH:
  Specify the time (in seconds) to send PUBLISH to refresh client publication before the actual interval expires.

Currently, media count setting is configurable via account setting only, which not really ideal for application, e.g: need to modify the account setting just for enabling video in an audio only session. So, media count manipulation should be done per call basis rather than per account basis.

Framework to publish and consume media events in a media flow. The event framework can be used by any media types (audio and video) and any objects.

Overview of the framework (pjmedia/event.h):

typedef enum pjmedia_event_type
{
    PJMEDIA_EVENT_NONE,
    PJMEDIA_EVENT_FMT_CHANGED,
    PJMEDIA_EVENT_WND_CLOSING,
    PJMEDIA_EVENT_WND_CLOSED,
    PJMEDIA_EVENT_WND_RESIZED,
    PJMEDIA_EVENT_MOUSE_BTN_DOWN,
    PJMEDIA_EVENT_KEY_FRAME_FOUND,
    PJMEDIA_EVENT_KEY_FRAME_MISSING,
    PJMEDIA_EVENT_USER = 100
} pjmedia_event_type;

typedef struct pjmedia_event
{
    pjmedia_event_type			 type;
    pj_timestamp		 	 timestamp;
    unsigned				 proc_cnt;
    const pjmedia_event_publisher	*epub;

    union {
	pjmedia_event_fmt_changed_data		fmt_changed;
	pjmedia_event_wnd_resized_data		wnd_resized;
	pjmedia_event_wnd_closing_data		wnd_closing;
	pjmedia_event_wnd_closed_data		wnd_closed;
	pjmedia_event_mouse_btn_down_data	mouse_btn_down;
	pjmedia_event_key_frame_found_data	key_frm_found;
	pjmedia_event_key_frame_missing_data	key_frm_missing;
	pjmedia_event_user_data			user;
	void					*ptr;
    } data;
} pjmedia_event;

typedef pj_status_t pjmedia_event_cb(pjmedia_event_subscription *esub,
				     pjmedia_event *event);

struct pjmedia_event_subscription
{
    PJ_DECL_LIST_MEMBER(pjmedia_event_subscription);
    pjmedia_event_cb	*cb;
    void		*user_data;
};

struct pjmedia_event_publisher
{
    pjmedia_event_subscription	subscription_list;
};

PJ_DECL(void) pjmedia_event_init(pjmedia_event *event,
                                 pjmedia_event_type type,
                                 const pj_timestamp *ts,
                                 const pjmedia_event_publisher *epub);
PJ_DECL(void) pjmedia_event_publisher_init(pjmedia_event_publisher *epub);
PJ_DECL(void) pjmedia_event_subscription_init(pjmedia_event_subscription *esub,
                                              pjmedia_event_cb *cb,
                                              void *user_data);
PJ_DECL(pj_status_t) pjmedia_event_subscribe(pjmedia_event_publisher *epub,
                                             pjmedia_event_subscription *esub);
PJ_DECL(pj_status_t) pjmedia_event_unsubscribe(pjmedia_event_publisher *epub,
                                               pjmedia_event_subscription *esub);
PJ_DECL(pj_status_t) pjmedia_event_publish(pjmedia_event_publisher *epub,
                                           pjmedia_event *event);
PJ_DECL(pj_status_t) pjmedia_event_republish(pjmedia_event_publisher *esrc,
                                             pjmedia_event_publisher *epub,
                                             pjmedia_event_subscription *esub);

Normally pjsua-lib would add "+sip.ice" media feature tag to account Contact parameters if ICE is enabled. However wrong initialization sequence in initialize_acc() function in pjsua_acc.c has caused this parameter to be omitted.

It should just return success.

There is more fix for this issue in #968.

Hanging up call quickly after making call may cause media transport to leak. This media transports will not get destroyed forever.

In double hold situation, media will be marked as a=inactive, and currently the media will be closed. This would cause the media transport to be reinitialized when the stream is resumed.

There are two known possible failures with this behavior, with ICE and SRTP. With ICE, we unnecessarily restart ICE negotiation, which will fail if remote still has the ICE session intact. And similarly this will cause inconsistent states between local and remote SRTP endpoints if only one side restarts the session.

More over, we should keep sending keep-alive packets even when the media is marked as inactive. This would be the argument to keep ICE session alive when media is inactive.

Destroying WAV file player/recorder with PJSUA API did not release the memory until application quits, since memory is allocated from the global pjsua's memory pool.

When application wants to specify its own buffer when registering an entry in the hash table, it calls pj_hash_set_np and gives it a buffer. This buffer normally is declared by application as:

  char buffer[PJ_HASH_ENTRY_SIZE];

This buffer will be typecasted to struct pj_hash_entry in hash.c:

struct pj_hash_entry
{
    struct pj_hash_entry *next;
    const void *key;
    pj_uint32_t hash;
    pj_uint32_t keylen;
    void *value;
};

And this is where the problem starts.

Since the buffer is of type array of char, this won't get aligned by compiler, and later in find_entry() in hash.c, it will cause unaligned memory access exception in assignment to entry->value.

Thanks ChenHuan <chenhuan at sict.ac.cn> for finding this problem!

See ticket #304

Related to ticket #309

When the clock thread is started and stopped multiple times, the clock thread pool will bloat and thread handle (and its mutex handle) will leak.

Original report is ​here.

The invite session uses single memory pool to allocate memory pool for its session data (such as negotiated SDPs, remote target, etc.), and by design, memory blocks are not freed until the pool is released, and for the invite session, this only happens when the session is terminated (call is hung up). Unfortunately, if the call is running for long period of time and with many re-INVITES, this will grow the memory consumption almost indefinitely.

When splitcomb's put_frame() is called with frame type NONE, it will generate zero-frame for its reversed channels, if any. The bug was in this zero-frame generation, i.e: bzero'd one-channel-size buffer with multichannel-size length.

Original report can be found ​here.

pj_sockaddr_parse() is using pj_sockaddr_in_set_str_addr() which is using pj_gethostbyname() which is using gethostbyname() which is not reentrant. So pj_sockaddr_parse() is practically not thread-safe.

Thanks Pirmin Walthert for the investigation and the initial patch.

The pj_ssl_sock_send() always tries to re-align the circular buffer for write operation without considering if the buffer is being used by any pending write operations.

• Fixed memory leak if video stream fails to be created
• Fixed crash when sending rtcp bye if create_stream() fails and stream transport hasn't been created.

The libSRTP's srtp_init() function allocates some variables which are not freed, causing memory leak.

The solution is to add srtp_deinit() function and register this with pj_atexit().

Some Speex echo canceller (mdf.c) internal variables don't seem to get freed, causing memory leak. This has been reported to Speex mailing list.

When local buffer length is less than what is required by GetAdapterAddresses(), function enum_ipv4_ipv6_interface() does't free the temporary buffer.

Steps to reproduce:

1. Make local buffer 1 byte length.
2. Call enum_ipv4_ipv6_interface()

static pj_status_t enum_ipv4_ipv6_interface(int af,
                        unsigned *p_cnt,
                        pj_sockaddr ifs[])
{
    pj_uint8_t buffer[600]; // Change buffer length to 1.
    IP_ADAPTER_ADDRESSES *adapter = (IP_ADAPTER_ADDRESSES*)buffer;
    ULONG size = sizeof(buffer);
    ULONG flags;
    unsigned i;
    DWORD rc;

    flags = GAA_FLAG_SKIP_FRIENDLY_NAME |
        GAA_FLAG_SKIP_DNS_SERVER |
        GAA_FLAG_SKIP_MULTICAST;

    rc = MyGetAdapterAddresses(af, flags, NULL, adapter, &size);
    if (rc != ERROR_SUCCESS) {
      if (rc == ERROR_BUFFER_OVERFLOW) {
        /* Retry with larger memory size */
        adapter = (IP_ADAPTER_ADDRESSES*) malloc(size); //  <==== Memory allocated
        if (adapter != NULL)
          rc = MyGetAdapterAddresses(af, flags, NULL, adapter, &size);
      }

      if (rc != ERROR_SUCCESS) {
        if (adapter != (IP_ADAPTER_ADDRESSES*)buffer)
        free(adapter);
        return PJ_RETURN_OS_ERROR(rc);
      }
    }

    /* Reset result */
    pj_bzero(ifs, sizeof(ifs[0]) * (*p_cnt));

    /* Enumerate interface */
    for (i=0; i<*p_cnt && adapter; adapter = adapter->Next) { //  <====  Condition adapter == NULL break loop

             .... 
    }

    if (adapter != (IP_ADAPTER_ADDRESSES*)buffer)
       free(adapter); // <==== Leak! adapter == NULL

    *p_cnt = i;
    return (*p_cnt) ? PJ_SUCCESS : PJ_ENOTFOUND;
}

Thank you Andrey Mamchur for the report

Suspected memory leak in qt_dev with GUI app

Calling pjmedia_vid_codec_mgr_set_default_param() multiple times using the same pool instance will cause the pool bloating. This is actually expected behaviour. It was assumed that application won't need to change the default codec param frequently. And if application needs to, it should manage the pool by itself, i.e: create new pool before and release the old one after calling the function, to avoid the pool bloating.

However, after reconsider it again, frequent changes on the default codec param can be common case for video applications, so we think it is better to let the codec framework to manage the pool.

Quoting Andrey's mail:

"I've ported the pjproject-1.0-rc4 to Solaris 10. I've discovered the memory leak at solaris2.10. It's interesting that the same code works OK at Linux. I investigated the tests for pjlib and increased the amount of pjlib tests to detect the problem. Because the memory leak is very small on original test suite.

It took the significant time to understand that memory leak relates to the mutex operations. So at the end I detected the problem.

The root cause is absence of pthread_mutexattr_destroy(&attr) call for initialized mutex attribute (pthread_mutexattr_t attr) in init_mutex function in os_core_unix.c. But POSIX Thread API demands it. Because it's PAIR CALL for pthread_mutexattr_init(&attr) (initialize/destroy approach). Each initialize call should be closed with destroy call for given mitex attribute variable.

So each time when pjsip mutex is created we have handle leak for mutex attribute inside OS.

We know that POSIX Thread API implementation is different on Linux & Solaris.

That's why we do not detect pjsip memory leaks under Linux. I think mutex attribute creation/destroying implementation does not use system handle needed to be destroyed."

When application exits, all transactions will be destroyed. However the transaction does not emit termination event to the transaction user (mostly dialog), thus these higher level objects will not be destroyed.

Report:

I am suspecting that PjSip has two memory leaks in INVITE transactions when PjSip is the UAC.

(1) One leak seems to be from pjsip_endpt_create_request_from_hdr(), called from pjsip_endpt_create_ack() - that is when constructing ACK for 3xx-6xx final response.

(2) Another leak seems to be when allocating a buffer in mod_on_tx_msg(). This buffer never seems to be removed.

It is reported that when you configure the library to use Speex for resampling, a memory leak occurs when a conference port is removed that has resample instances associated with it.

Resamples instances are created during the call to create_conf_port() but are not destroyed anywhere and will lead to memory leak.

This ticket will also disable pjmedia_conf_add_passive_port() which is already deprecated since 1.3 .

Thanks to Andreas Wehrmann for the report, patch and suggestion.

When alignment is set to be greater than 4 bytes, the memory allocated from the pool may not be aligned to the required alignment, because the pool's start memory block is not aligned to the required alignment.

When alignment is set to be greater than default alignment, the memory allocated from the pool may not be aligned to the required alignment, because the pool's start memory block is not aligned to the required alignment.

Note that ticket #980 had attempted to fix this but it missed few other locations where the bug occurs.

Paul Levin suggested there are some memory problems when pjsip is Purified, such as memory leaks, UMR (Uninitialized Memory Read), FMR (Free Memory Read), etc.

Verify this.

Currently the message buffer is simply set to the packet buffer:

dst->msg_info.msg_buf = dst->pkt_info.packet;

while for connection oriented transports, the SIP message boundary is not always in the beginning of the packet buffer.

Thanks to Andrew A. Chernyh for the patch.

Reported that G.722 audio has metallic reverberation only when video is active.

This is easily reproducible with pjsua using param "--video --add-codec G722 sip:localhost".

After investigation, we found out that in the beginning of call, some G.722 RTP packets use clock rate 16kHz (for about first 15 packets) and the rest of the session use 8kHz, so the stream receiver thinks that remote uses 16kHz for G.722 RTP packets for the whole G.722 audio session (see also #486 about RFC bug on G.722 clock rate). Those first bad packets are actually silence frames generated by stream when it has no transmitter (in the conference bridge) in the beginning of the call (seems to be caused by media setup lag).

Thanks Matynka Bartosz for the report.

Tasks:

1. Convert pjsua and pjsua2 app sample projects.
2. Adjust PJSIP build configs (Makefile, etc).
3. Update wiki.

This ticket contains the changeset containing current video works that has been developed in a private repository. The current state of the video work is as follows:

1. major refactoring of pjmedia base types to support video (pjmedia_format, pjmedia_port, etc.)
2. (new) video devices:
   • SDL renderer
   • Video4Linux4 capture
   • DirectShow capture
   • ffmpeg capture (unfinished)
   • Color bar
3. (new) video device port (analogous to sound device port)
4. (new) format conversion framework
   • .. with ffmpeg's libswscale implementation
5. (new) video codec framework
   • .. with ffmpeg's libavcodec implementation
6. (new) AVI file reader

This is the placeholder for minor fixes for PJSIP.

• Setting audio session category is now during stream creation instead of in the factory initialization.
• Reset the audio session category after an interruption.
• By default, audio route change property listener is disabled as it is no longer required.

Placeholder for miscellaneous / minor fixes.

This is the placeholder for any fixes to PocketPJ, the Windows Mobile sample application.

Small and miscellaneous commits go here.

Small and miscellaneous commits go here.

This ticket holds various minor fixes.

This is placeholder for miscellaneous fixes across all projects. The corresponding ticket for 1.0 branch is ticket #773

This is duplicate of ticket #772 and #838 for 1.0 branch. It is a placeholder for miscellaneous fixes across all projects in 1.0 branch.

This is placeholder for miscellaneous or minor fixes.

This is placeholder for miscellaneous or minor fixes.

This is placeholder for miscellaneous/minor fixes.

This is the placeholder for miscellaneous fixes for this release.

This is the placeholder for miscellaneous or minor fixes

This ticket is container for miscellaneous fixes.

Miscellaneous and minor fixes here.

Miscellaneous and minor fixes here.

Miscellaneous and minor fixes here.

Miscellaneous or minor fixes.

Miscellaneous fixes

Miscellaneous updates and fixes.

Miscellaneous updates and fixes.

Miscellaneous updates and fixes.

Miscellaneous updates and fixes.

Miscellaneous updates and fixes.

Miscellaneous updates and fixes

Miscellaneous updates and fixes

Miscellaneous updates and fixes

Miscellaneous updates and fixes

Miscellaneous updates and fixes

Miscellaneous updates and fixes

Invalid ticket. Miscellaneous fixes will not be backported to 1.x (and 1.x has been deprecated anyway)

This is placeholder ticket for miscellaneous/minor fixes on this release.

This is the placeholder for miscellaneous fixes for applications. The corresponding ticket for the 1.0 branch is ticket #717.

This is the placeholder for miscellaneous fixes for applications. The corresponding ticket for the trunk is ticket #716.

This ticket is the placeholder for miscellaneous fixes for PJLIB. The corresponding ticket for the 1.0 branch is ticket #715.

This ticket is placeholder for miscellaneous fixes for pjlib. The corresponding ticket for the trunk is ticket #703.

This ticket is placeholder for miscellaneous fixes for pjmedia.

This ticket is placeholder for miscellaneous fixes for pjmedia. The corresponding ticket for the trunk is ticket #720.

This is the placeholder for miscellaneous or minor fixes for pjsua-lib. The corresponding ticket for the 1.0.x branch is ticket #725

This is the placeholder for miscellaneous or minor fixes for pjsua-lib. The corresponding ticket for the trunk branch is ticket #724.

This is the place holder for miscellaneous fixes.

The corresponding ticket for the 1.0 branch is ticket #708

This is duplicate of ticket #707 for 1.0 branch.

Miscellaneous fixes below.

• Assertion in pjmedia tests's MIPS test with iLBC codec due to ptime mismatch:
  • The MIPS test assumes that iLBC will work with mode 20 since it is initialized with mode 20, but actually the codec works at mode 30 since the initialization is missing encoding ptime parameter (hence iLBC correctly assumes that default mode should be used)

This is the placeholder for misc jitter buffer updates and fixes.

Symptoms:

• VoiceAge? G.722 to PJMEDIA G.722: recieved signal is 6dB lower
• PJMEDIA G.722 to VoiceAge? G.722: received signal is 6dB stronger (200%) and get distorted from clipping.

As specified ​here:

   If the refresher parameter in the Session-Expires header field in the
   2xx response has a value of 'uac', the UAS MUST place a Require
   header field into the response with the value 'timer'.

Thanks Rui Macedo for the report.

CSeq is not checked for incoming ACK request. This may cause ACK retransmission for previous INVITE transaction to wrongly be processed.

Sample scenario:

1. Receiving normal INVITE with SDP, processed normally until reaching confirmed state, let's call this TSX 1.
2. Receiving re-INVITE without SDP, responded 200 OK with SDP, and waiting for an ACK with SDP, let's call this TSX 2.
3. Receiving ACK retransmission of TSX 1, problem start here: it is processed as if it is for TSX 2, as there is no SDP, the local SDP offer of TSX 2 gets cancelled, so there is no media session update.
4. Receiving ACK with SDP for TSX 2, the SDP is ignored as SDP negotiator is in state DONE.

Polycom DMA rejects our video offer because it's missing "max-fs" H264 parameter. They need it to calculate bandwidth needed. See also #1244

Reported error logs:

Failed creating STUN transport #1 for comp 1: gethostbyname() has returned error (PJ_ERESOLVE)

Failed creating STUN transport #1 for comp 1: Not found (PJ_ENOTFOUND)

The PJ_ERESOLVE error seems to be caused by IPv4 address being resolved to IPv6 address, note that when configured STUN server has IPv4 and it works, only the IPv4 STUN server address will be used.

While the PJ_ENOTFOUND error seems to be caused by failure in host interface enumeration (pj_enum_ip_interface()).

So, in generating STUN & host candidates, I think we should be more forgiving on errors (e.g: skipping STUN Binding resolution when STUN server resolution fails, use default address when host interface enumeration fails).

Thanks Oded Arbel for the report.

PJSIP did not add To tag for responses which are outside or do not create dialog, and this does not conform with Section 8.2.6.2 of RFC 3261:

... the UAS MUST add a tag to the To header field in the response (with the exception of the 100 (Trying) response, in which a tag MAY be present)