Opened 8 years ago

Last modified 8 years ago

#1902 closed defect

Crash when endpoint has multiple worker threads and SIP TCP transport is disconnected during incoming call handling — at Initial Version

Reported by: nanang Owned by: bennylp
Priority: normal Milestone: release-2.5
Component: pjsua-lib Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

Scenario:

  1. Run pjsua with multiple worker threads, e.g: with --thread-cnt=2 param.
  2. Receive a call via TCP transport and disconnect the transport immediately (can be simulated by adding code to shutdown the transport in the incoming call callback pjsua_call_on_incoming()).
  3. The thread handling incoming call may crash at any point when accessing the dialog (usually still inside pjsua_call_on_incoming() function), as the dialog is already destroyed prematurely by other working thread after transport is disconnected.

Sample call stack (crash when trying to use dialog's pool while dialog is already destroyed):

pj_pool_alloc_from_block(pj_pool_block * block, unsigned __int64 size) Line 50	C
pj_pool_alloc(pj_pool_t * pool, unsigned __int64 size) Line 60	C
pj_strdup(pj_pool_t * pool, pj_str_t * dst, const pj_str_t * src) Line 40	C
pjsip_tpmgr_find_local_addr2(pjsip_tpmgr * tpmgr, pj_pool_t * pool, pjsip_tpmgr_fla2_param * prm) Line 1510	C
pjsua_acc_get_uac_addr(int acc_id, pj_pool_t * pool, const pj_str_t * dst_uri, pjsip_host_port * addr, pjsip_transport_type_e * p_tp_type, int * secure, const void * * p_tp) Line 3118	C
pjsua_call_on_incoming(pjsip_rx_data * rdata) Line 1389	C
...

Thanks Itay Bianco for the report.

Change History (0)

Note: See TracTickets for help on using tickets.