[reSIProcate] Ares crash on dns answer

[Scott Godin]

Thanks Taras!

I will commit a fix for this.

Scott


On Fri, Sep 6, 2013 at 11:19 AM, palladin <p-aladin at yandex.ru> wrote:

> Dear resiprocate devels,
>
> resiprocate version - 1.8.8
> I have met dns crash.
> Please consider next stack:
>
> #0 0x00007fe3fdc18d81 in read_tcp_data (channel=0x1f18a80, server_idx=0,
> read_fds=<value optimized out>, now=1377154450) at ares_process.c:274
> #1 0x00007fe3fdc19147 in ares_process_poll (channel=0x1f18a80,
> server_idx=0, rdFd=35, wrFd=<value optimized out>, now=1377154450) at
> ares_process.c:102
> #2 0x00007fe3fe18d344 in resip::AresDnsPollItem::**processPollEvent
> (this=0x7fe3a00092d0, mask=<value optimized out>) at dns/AresDns.cxx:85
> #3 0x00007fe3fe18352d in resip::FdPollGrp::processItem (this=<value
> optimized out>, item=<value optimized out>, mask=<value optimized out>) at
> FdPoll.cxx:65
> #4 0x00007fe3fe184159 in resip::FdPollImplEpoll::**epollWait
> (this=0x21a6530, waitMs=0) at FdPoll.cxx:855
> #5 0x00007fe3fe1844da in resip::FdPollImplEpoll::**waitAndProcess
> (this=0x21a6530, ms=<value optimized out>) at FdPoll.cxx:768
> #6 0x00007fe3fe197b0e in resip::DnsThread::thread (this=0x216d3f0) at
> dns/DnsThread.cxx:33
> #7 0x00007fe3fe187e3a in threadIfThreadWrapper (threadParm=<value
> optimized out>) at ThreadIf.cxx:51
> #8 0x00007fe3ff717851 in start_thread (arg=0x7fe3e97fb700) at
> pthread_create.c:301
> #9 0x00007fe3f983f11d in clone () at ../sysdeps/unix/sysv/linux/**
> x86_64/clone.S:115
>
> As I can see read_tcp_data does not check fd_set on NULL and tries to
> dereference it. Also I have noticed that similar function
> read_udp_packets,which follows
> read_tcp_data, does that check.  It looks like when read_tcp_data became
> used with epoll( instead of select ) someone forgot to add verification of
> passed fd_set pointer.
>
> Sincerely,
> Taras Shypytiak.
> ______________________________**_________________
> resiprocate-devel mailing list
> resiprocate-devel at resiprocate.**org <resiprocate-devel at resiprocate.org>
> https://list.resiprocate.org/**mailman/listinfo/resiprocate-**devel<https://list.resiprocate.org/mailman/listinfo/resiprocate-devel>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://list.resiprocate.org/pipermail/resiprocate-devel/attachments/20130910/4f6a6c78/attachment.htm>