#1864 closed defect (fixed)
Assert and crash when remote remove and add back media lines in SDP
Reported by: | ming | Owned by: | bennylp |
---|---|---|---|
Priority: | normal | Milestone: | release-2.4.5 |
Component: | pjsua-lib | Version: | trunk |
Keywords: | Cc: | ||
Backport to 1.x milestone: | Backported: | no |
Description (last modified by nanang)
Reported scenarios:
Scenario 1 - assertion of "Currently no media transport reuse"
- receive offer with 2 media lines, RTP/SAVP and RTP/AVP, both active
- accept with 2 media lines in answer, RTP/SAVP gets port zeroed and RTP/AVP active (SRTP mode is set to disabled)
- receive reoffer with only 1 media line, RTP/AVP
- accept the reoffer
- receive reoffer with 2 media lines as in no 1, and assert occurs
It is caused by improper stopping and clean up of the removed media.
Scenario 2 - crash after accessing invalid call_med->tp pointer
- receive offer with 2 media lines, RTP/SAVP and RTP/AVP, both active
- send answer with 2 media lines, RTP/SAVP gets port zeroed and RTP/AVP active (SRTP mode is set to disabled)
- receive reoffer with only 1 media line, RTP/AVP
- reject the reoffer (e.g: because of no matching codec)
- receive reoffer with 2 media lines as in no 1, crash occurs
This seems to be a bug in r5124 (initial fix of scenario 1), it stops the removed media stream and cleans up its media transport right after receiving reoffer with less media lines (no 3), so when the SDP nego fails (the re-offer is rejected), call media states become inconsistent. Note that in SDP reoffer/answer, we shouldn't modify the media streams before SDP nego is done, as if SDP nego fails, the media streams should be maintained as if there is no SDP reoffer.
Also revisiting a related ticket #1626, where it modifies the media streams before SDP nego: the assertion happens because it gets into unknown media type block handler, while it should never do. So we need to update the fix, e.g: only set the media type when it is undefined.
Thanks to Brian Walker for the reports.
Change History (3)
comment:1 Changed 9 years ago by ming
- Resolution set to fixed
- Status changed from new to closed
comment:2 Changed 9 years ago by nanang
- Description modified (diff)
- Summary changed from Assertion in PJSIP when remote remove and add back media lines in the SDP to Assert and crash when remote remove and add back media lines in SDP
comment:3 Changed 9 years ago by nanang
In 5135:
In 5124: