[reSIProcate] NULL Pointer crash with resip 1.3.3 - [PATCH] for part of issue
Robert Sparks
rjsparks at nostrum.com
Tue Jul 15 08:19:31 CDT 2008
reading fast, but without going to look at code context, I don't think
this patch is ok.
Using To: as fodder for either Target of a dialog is incorrect. There
are some edge cases
(compatibility with devices that don't put Contacts in dialog forming
messages - i.e. some
really _old_ 2543 stuff or some stuff that's so broken it really
shouldn't be used) where you
might use To:/From: as backfiller because there's just nothing else to
do. But this patch
looks like (again, I haven't gone to look at the context) like it
would make it the normal
case, even to the point of ignoring a Contact that's present. That
will break things.
RjS
On Jul 14, 2008, at 7:16 PM, Aron Rosenberg wrote:
> Here is a simple patch which I believe addresses part of the issue
> we are seeing.
>
> Index: resip/dum/ClientSubscription.cxx
> ===================================================================
> --- resip/dum/ClientSubscription.cxx (revision 8133)
> +++ resip/dum/ClientSubscription.cxx (working copy)
> @@ -78,10 +78,7 @@
> if (!mOnNewSubscriptionCalled && !getAppDialogSet()-
> >isReUsed())
> {
> InfoLog (<< "[ClientSubscription] " << mLastRequest-
> >header(h_To));
> - if (msg.exists(h_Contacts))
> - {
> - mDialog.mRemoteTarget = msg.header(h_Contacts).front();
> - }
> + mDialog.mRemoteTarget = msg.header(h_To);
>
> handler->onNewSubscription(getHandle(), msg);
> mOnNewSubscriptionCalled = true;
> --
>
> The original symptom of an empty From/To header was caused by the
> mRemoteTarget being set with the contact address which is almost
> always (IP:Port) or just (DNS name:port). The mRemoteTarget was then
> used to build the resubscribe if you requested it which resulted in
> the empty to/from username.
>
> I believe that all the if…else cases which tested mRemoteTarget for
> Uri / Host values aren’t needed if the above is fixed properly.
>
> There is still the issue that the getAppDialogSet() crashes since
> the pointer is NULL
>
> -Aron
>
>
>
> From: resiprocate-devel-bounces at resiprocate.org [mailto:resiprocate-devel-bounces at resiprocate.org
> ] On Behalf Of Aron Rosenberg
> Sent: Monday, July 14, 2008 4:20 PM
> To: resiprocate-devel
> Subject: Re: [reSIProcate] NULL Pointer crash with resip 1.3.3
>
> I was finally able to get a working pcap, resip log and debug crash
> at the same time. Here is what is going on
>
> 1. Client makes subscription
> 2. Client ends the subscription by invoking end() on the handle
> 3. This end results in a local 408 error, which calls
> onRequestRetry
> 4. Our code returns 0 to
> onRequestRetry(ClientSubscriptionHandle) to retry the request since
> we want the server to know we ended the sub
> 5. "Application requested immediate retry on Retry-After" is
> printed to log
> 6. Crash happens in the else statement in
> ClientSubscription.cxx:198 when trying to call getAppDialogSet()-
> >reuse().
>
> I have a full log (over 100MB of resip data which I can send to a
> developer who wants to look at it along with the matching pcap error
> file
>
> -Aron
>
>
> From: resiprocate-devel-bounces at resiprocate.org [mailto:resiprocate-devel-bounces at resiprocate.org
> ] On Behalf Of Aron Rosenberg
> Sent: Monday, July 14, 2008 2:17 PM
> To: resiprocate-devel
> Subject: Re: [reSIProcate] NULL Pointer crash with resip 1.3.3
>
> Here is a little bit more information gleaned from a pcap trace.
>
> The stack seems to be crashing when dealing with a 400 error where
> the “From:” header looks like this
>
> “From: <sip:>;tag=5b461e50”
>
> I was able to find the outbound SUBSCRIBE request and it also has an
> empty From address so something strange is going on in the stack.
> Still working on getting the resip logs.
>
> -Aron
>
> From: resiprocate-devel-bounces at resiprocate.org [mailto:resiprocate-devel-bounces at resiprocate.org
> ] On Behalf Of Aron Rosenberg
> Sent: Monday, July 14, 2008 11:50 AM
> To: resiprocate-devel
> Subject: [reSIProcate] NULL Pointer crash with resip 1.3.3
>
> Resip ver: SVN rev 8128 on 1.3 branch
>
> Call Stack:
> resip::AppDialogSet::getHandle() Line 22 + 0x3 bytes C++
> resip::DialogUsage::getAppDialogSet() Line 38 + 0x18 bytes C++
> resip::ClientSubscription::processResponse(const resip::SipMessage &
> msg={...}) Line 198 + 0x12 bytes C++
> resip::ClientSubscription::dispatch(const resip::SipMessage &
> msg={...}) Line 117 C++
> resip::Dialog::dispatch(const resip::SipMessage & msg={...}) Line
> 651 + 0x1a bytes C++
> resip::DialogSet::dispatchToAllDialogs(const resip::SipMessage &
> msg={...}) Line 1028 C++
> resip::DialogSet::dispatch(const resip::SipMessage & msg={...}) Line
> 608 C++
> resip::DialogUsageManager::processResponse(const resip::SipMessage &
> response={...}) Line 1810 C++
> resip
> ::DialogUsageManager::incomingProcess(std::auto_ptr<resip::Message>
> msg=auto_ptr {tu=??? }) Line 1363 C++
> resip
> ::DialogUsageManager::internalProcess(std::auto_ptr<resip::Message>
> msg=auto_ptr {tu=??? }) Line 1190 C++
> resip::DialogUsageManager::process(resip::RWMutex *
> mutex=0x00000000) Line 1390 + 0x49 bytes C++
> SipEP::run() Line 3408 + 0xa bytes C++
>
> The crash is because the appDialogSet returned in
> DialogUsage::getAppDialogSet() is NULL.
>
> It came from our production client and is reasonable repeatable, so
> I am working on getting the resip logs that would go with it.
>
> -Aron
>
>
> ---------------------------------------------
> Aron Rosenberg
> Founder and CTO
> SightSpeed - http://www.sightspeed.com/
>
> 918 Parker St, Suite A14
> Berkeley, CA 94710
>
> Email: arosenberg at sightspeed.com
> Phone: 510-665-2920
> Cell: 510-847-7389
> Fax: 510-649-9569
> SightSpeed Video Link: http://aron.sightspeed.com
>
>
>
> _______________________________________________
> resiprocate-devel mailing list
> resiprocate-devel at resiprocate.org
> https://list.resiprocate.org/mailman/listinfo/resiprocate-devel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://list.resiprocate.org/pipermail/resiprocate-devel/attachments/20080715/fe94dfae/attachment.htm>
More information about the resiprocate-devel
mailing list