[reSIProcate] NULL Pointer crash with resip 1.3.3 - [PATCH] for part of issue

[Aron Rosenberg]

Here is a simple patch which I believe addresses part of the issue we
are seeing.

 

Index: resip/dum/ClientSubscription.cxx

===================================================================

--- resip/dum/ClientSubscription.cxx      (revision 8133)

+++ resip/dum/ClientSubscription.cxx   (working copy)

@@ -78,10 +78,7 @@

       if (!mOnNewSubscriptionCalled && !getAppDialogSet()->isReUsed())

       {

          InfoLog (<< "[ClientSubscription] " <<
mLastRequest->header(h_To));

-         if (msg.exists(h_Contacts))

-         {

-            mDialog.mRemoteTarget = msg.header(h_Contacts).front();

-         }

+         mDialog.mRemoteTarget = msg.header(h_To);

          

          handler->onNewSubscription(getHandle(), msg);

          mOnNewSubscriptionCalled = true;

--

 

The original symptom of an empty From/To header was caused by the
mRemoteTarget being set with the contact address which is almost always
(IP:Port) or just (DNS name:port). The mRemoteTarget was then used to
build the resubscribe if you requested it which resulted in the empty
to/from username.

 

I believe that all the if...else cases which tested mRemoteTarget for
Uri / Host values aren't needed if the above is fixed properly.

 

There is still the issue that the getAppDialogSet() crashes since the
pointer is NULL

 

-Aron

 

 

 

From: resiprocate-devel-bounces at resiprocate.org
[mailto:resiprocate-devel-bounces at resiprocate.org] On Behalf Of Aron
Rosenberg
Sent: Monday, July 14, 2008 4:20 PM
To: resiprocate-devel
Subject: Re: [reSIProcate] NULL Pointer crash with resip 1.3.3

 

I  was finally able to get a working pcap, resip log and debug crash at
the same time. Here is what is going on

 

1.       Client makes subscription

2.       Client ends the subscription by invoking end() on the handle

3.       This end results in a local 408 error, which calls
onRequestRetry

4.       Our code returns 0 to onRequestRetry(ClientSubscriptionHandle)
to retry the request since we want the server to know we ended the sub

5.       "Application requested immediate retry on Retry-After" is
printed to log

6.       Crash happens in the else statement in
ClientSubscription.cxx:198 when trying to call
getAppDialogSet()->reuse().

 

I have a full log (over 100MB of resip data which I can send to a
developer who wants to look at it along with the matching pcap error
file

 

-Aron

 

 

From: resiprocate-devel-bounces at resiprocate.org
[mailto:resiprocate-devel-bounces at resiprocate.org] On Behalf Of Aron
Rosenberg
Sent: Monday, July 14, 2008 2:17 PM
To: resiprocate-devel
Subject: Re: [reSIProcate] NULL Pointer crash with resip 1.3.3

 

Here is a little bit more information gleaned from a pcap trace.

 

The stack seems to be crashing when dealing with a 400 error where the
"From:" header looks like this

 

"From: <sip:>;tag=5b461e50"

 

I was able to find the outbound SUBSCRIBE request and it also has an
empty From address so something strange is going on in the stack. Still
working on getting the resip logs.

 

-Aron

 

From: resiprocate-devel-bounces at resiprocate.org
[mailto:resiprocate-devel-bounces at resiprocate.org] On Behalf Of Aron
Rosenberg
Sent: Monday, July 14, 2008 11:50 AM
To: resiprocate-devel
Subject: [reSIProcate] NULL Pointer crash with resip 1.3.3

 

Resip ver: SVN rev 8128 on 1.3 branch

 

Call Stack: 

resip::AppDialogSet::getHandle() Line 22 + 0x3 bytes C++
resip::DialogUsage::getAppDialogSet() Line 38 + 0x18 bytes C++
resip::ClientSubscription::processResponse(const resip::SipMessage &
msg={...}) Line 198 + 0x12 bytes C++
resip::ClientSubscription::dispatch(const resip::SipMessage & msg={...})
Line 117 C++
resip::Dialog::dispatch(const resip::SipMessage & msg={...}) Line 651 +
0x1a bytes C++
resip::DialogSet::dispatchToAllDialogs(const resip::SipMessage &
msg={...}) Line 1028 C++
resip::DialogSet::dispatch(const resip::SipMessage & msg={...}) Line 608
C++
resip::DialogUsageManager::processResponse(const resip::SipMessage &
response={...}) Line 1810 C++
resip::DialogUsageManager::incomingProcess(std::auto_ptr<resip::Message>
msg=auto_ptr {tu=??? }) Line 1363 C++
resip::DialogUsageManager::internalProcess(std::auto_ptr<resip::Message>
msg=auto_ptr {tu=??? }) Line 1190 C++
resip::DialogUsageManager::process(resip::RWMutex * mutex=0x00000000)
Line 1390 + 0x49 bytes C++
SipEP::run() Line 3408 + 0xa bytes C++

 

The crash is because the appDialogSet returned in
DialogUsage::getAppDialogSet() is NULL.

 

It came from our production client and is reasonable repeatable, so I am
working on getting the resip logs that would go with it.

 

-Aron

 

 

---------------------------------------------

Aron Rosenberg

Founder and CTO

SightSpeed - http://www.sightspeed.com/

 

918 Parker St, Suite A14

Berkeley, CA 94710

 

Email: arosenberg at sightspeed.com

Phone: 510-665-2920

Cell: 510-847-7389

Fax: 510-649-9569

SightSpeed Video Link: http://aron.sightspeed.com
<http://aron.sightspeed.com/> 

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://list.resiprocate.org/pipermail/resiprocate-devel/attachments/20080714/0e18a00f/attachment.htm>