< Previous by Date Date Index Next by Date >
  Thread Index Next in Thread >

[reSIProcate] Ares crash on dns answer


Dear resiprocate devels,

resiprocate version - 1.8.8
I have met dns crash.
Please consider next stack:

#0 0x00007fe3fdc18d81 in read_tcp_data (channel=0x1f18a80, server_idx=0, read_fds=<value optimized out>, now=1377154450) at ares_process.c:274 #1 0x00007fe3fdc19147 in ares_process_poll (channel=0x1f18a80, server_idx=0, rdFd=35, wrFd=<value optimized out>, now=1377154450) at ares_process.c:102 #2 0x00007fe3fe18d344 in resip::AresDnsPollItem::processPollEvent (this=0x7fe3a00092d0, mask=<value optimized out>) at dns/AresDns.cxx:85 #3 0x00007fe3fe18352d in resip::FdPollGrp::processItem (this=<value optimized out>, item=<value optimized out>, mask=<value optimized out>) at FdPoll.cxx:65 #4 0x00007fe3fe184159 in resip::FdPollImplEpoll::epollWait (this=0x21a6530, waitMs=0) at FdPoll.cxx:855 #5 0x00007fe3fe1844da in resip::FdPollImplEpoll::waitAndProcess (this=0x21a6530, ms=<value optimized out>) at FdPoll.cxx:768 #6 0x00007fe3fe197b0e in resip::DnsThread::thread (this=0x216d3f0) at dns/DnsThread.cxx:33 #7 0x00007fe3fe187e3a in threadIfThreadWrapper (threadParm=<value optimized out>) at ThreadIf.cxx:51 #8 0x00007fe3ff717851 in start_thread (arg=0x7fe3e97fb700) at pthread_create.c:301 #9 0x00007fe3f983f11d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

As I can see read_tcp_data does not check fd_set on NULL and tries to dereference it. Also I have noticed that similar function read_udp_packets,which follows read_tcp_data, does that check. It looks like when read_tcp_data became used with epoll( instead of select ) someone forgot to add verification of passed fd_set pointer.

Sincerely,
Taras Shypytiak.