Opened 4 years ago

Closed 4 years ago

#1834 closed defect (fixed)

Crash in SDP negotiator due to access to invalid memory space

Reported by: nanang Owned by: nanang
Priority: normal Milestone: release-2.4
Component: pjmedia Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

INVITE session uses an alternating set of memory pools where the last used is reset after a cycle of SDP negotiation, this requires SDP negotiator to retain some of its internal states using the current pool in each SDP negotiation cycle, however there is a scenario where it fails to retain internal state initial_sdp:

  1. normal SDP offer/answer + negotiation, this cycle uses pool 1
  2. send reoffer using pjmedia_sdp_neg_send_local_offer(), this cycle uses pool 2, unfortunately initial_sdp is not retained by pjmedia_sdp_neg_send_local_offer(), so after SDP nego, pool 1 is reset and initial_sdp becomes invalid
  3. receive reoffer, when answering using pjmedia_sdp_neg_set_local_answer(), the invalid initial_sdp is accessed.

Thanks Joshua Colp for the report and the patch.

Change History (1)

comment:1 Changed 4 years ago by nanang

  • Resolution set to fixed
  • Status changed from new to closed

In 5040:

Fix #1834: Fixed SDP negotiator to retain initial_sdp in pjmedia_sdp_neg_send_local_offer().

Note: See TracTickets for help on using tickets.