Ticket #366 (closed defect: fixed)

Opened 10 years ago

Last modified 10 years ago

Crash in SDP negotiator when initial local SDP is not specified in pjmedia_sdp_neg_create_w_local_offer() (thanks Philippe Leuba)

Reported by: bennylp Owned by: bennylp
Priority: normal Milestone: release-0.8.0
Component: pjmedia Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported:

Description

Quoting Philippe's email in pjsip list:

We found a problem in the SDP negotiator that crashes with a null pointer.

We create the negotiator with create_w_remote_offer without passing a local SDP. We pass it later with the set_local_answer. When the negotiate method is called, this crash because the inititial_sdp pointer is null and nevertheless used to read the previous origin.version.

I propose to modify the set_locale_answer method by adding the following lines:

      if (!neg->initial_sdp)
        neg->initial_sdp = pjmedia_sdp_session_clone(pool, local);

just before the existing line:

      neg->neg_local_sdp = pjmedia_sdp_session_clone(pool, local);

Change History

comment:1 Changed 10 years ago by bennylp

  • Status changed from new to closed
  • Resolution set to fixed

Fixed in r1427.

Note: See TracTickets for help on using tickets.