Opened 8 years ago

#1973 new defect

Data races in pjmedia stream

Reported by: nanang Owned by: nanang
Priority: normal Milestone: Known-Issues-and-Ideas
Component: pjmedia Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

Reported that race condition scenarios potentially occur in pjmedia_stream specifically in call hangup where UI/SIP thread invokes pjmedia_stream_destroy() and media/audio thread that may still doing some streaming processing, both may access the same pjmedia_stream states without mutex protection. For example, pjmedia_rtcp_build_rtcp_sdes() may be called at the same time:

UI/SIP thread:

    #0 pjmedia_rtcp_build_rtcp_sdes pjproject/pjmedia/build/../src/pjmedia/rtcp.c:1014:10
    #1 send_rtcp pjproject/pjmedia/build/../src/pjmedia/stream.c:991:11
    #2 pjmedia_stream_send_rtcp_bye pjproject/pjmedia/build/../src/pjmedia/stream.c:2943:9
    #3 pjsua_aud_stop_stream pjproject/pjsip/build/../src/pjsua-lib/pjsua_aud.c:505:2
    #4 stop_media_stream pjproject/pjsip/build/../src/pjsua-lib/pjsua_media.c:2462:2
    #5 stop_media_session pjproject/pjsip/build/../src/pjsua-lib/pjsua_media.c:2514:2
    #6 pjsua_media_channel_deinit pjproject/pjsip/build/../src/pjsua-lib/pjsua_media.c:2538:5
    ...

Media endpoint thread:

    #0 pjmedia_rtcp_build_rtcp_sdes pjproject/pjmedia/build/../src/pjmedia/rtcp.c:1014:10
    #1 send_rtcp pjproject/pjmedia/build/../src/pjmedia/stream.c:991:11
    #2 on_rx_rtp pjproject/pjmedia/build/../src/pjmedia/stream.c:1905:11
    ...

Thanks Kal for the report. Original report can be found ​here

Change History (0)

Note: See TracTickets for help on using tickets.