6 Mar
2017
6 Mar
'17
11:10 p.m.
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "MNCC <-> SIP bridge".
The branch, master has been updated
via 49880ddf740a7af47a1247dbff9acb34087b6afc (commit)
via 068f54795495d478e51d40dfcd390ce005933f9d (commit)
from 7166d0f448eae451b1a6287b522c0fc82387b05b (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://cgit.osmocom.org/osmo-sip-connector/commit/?id=49880ddf740a7af47a124…
commit 49880ddf740a7af47a1247dbff9acb34087b6afc
Author: Holger Hans Peter Freyther <holger(a)moiji-mobile.com>
Date: Mon Mar 6 10:02:37 2017 +0100
mncc: Fix use after free on mncc socket disconnection
When the MNCC socket breaks down we would release all callds but when
there is no remote call the call would be released before
if (call->remote)
...
is being executed leading to a use after free. Fix it by copying the
legs first and assuming the call will be gone after that.
==3618== Invalid read of size 4
==3618== at 0x804A18A: app_mncc_disconnected (app.c:49)
==3618== by 0x804B52D: close_connection (mncc.c:255)
==3618== by 0x804BCFA: mncc_rtp_send.constprop.13 (mncc.c:145)
==3618== by 0x804CC86: check_setup (mncc.c:435)
==3618== by 0x804CC86: mncc_data (mncc.c:795)
==3618== by 0x42FCF94: osmo_fd_disp_fds (select.c:167)
==3618== by 0x804D1F2: evpoll (evpoll.c:92)
==3618== by 0x4205053: ??? (in /lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3618== by 0x4205478: g_main_loop_run (in
/lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3618== by 0x8049AA6: main (main.c:171)
==3618== Address 0x47f3258 is 64 bytes inside a block of size 76 free'd
==3618== at 0x402A3A8: free (vg_replace_malloc.c:473)
==3618== by 0x42E7FD1: ??? (in /usr/lib/i386-linux-gnu/libtalloc.so.2.1.5)
==3618== by 0x804A3FD: call_leg_release (call.c:87)
==3618== by 0x804A186: app_mncc_disconnected (app.c:48)
==3618== by 0x804B52D: close_connection (mncc.c:255)
==3618== by 0x804BCFA: mncc_rtp_send.constprop.13 (mncc.c:145)
==3618== by 0x804CC86: check_setup (mncc.c:435)
==3618== by 0x804CC86: mncc_data (mncc.c:795)
==3618== by 0x42FCF94: osmo_fd_disp_fds (select.c:167)
==3618== by 0x804D1F2: evpoll (evpoll.c:92)
==3618== by 0x4205053: ??? (in /lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3618== by 0x4205478: g_main_loop_run (in
/lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3618== by 0x8049AA6: main (main.c:171)
==3618==
Change-Id: I1889013ed315f896e4295358f6daf76ce523dc2a
http://cgit.osmocom.org/osmo-sip-connector/commit/?id=068f54795495d478e51d4…
commit 068f54795495d478e51d40dfcd390ce005933f9d
Author: Holger Hans Peter Freyther <holger(a)moiji-mobile.com>
Date: Mon Mar 6 09:50:26 2017 +0100
call: Fix call release handling on mncc connection loss
The app_mncc_disconnected will be called when the MNCC socket is down
and lead to all calls being released. It directly released the call but
did not stop the MNCC CMD timer. Go through the call release callback.
==3618== at 0x804A18A: app_mncc_disconnected (app.c:49)
==3618== by 0x804B52D: close_connection (mncc.c:255)
This lead to the timer not being removed:
==3593== Invalid read of size 4
==3593== at 0x4305D42: rb_first (rbtree.c:294)
==3593== by 0x42FCB37: osmo_timers_update (timer.c:220)
==3593== by 0x804D1D5: evpoll (evpoll.c:89)
==3593== by 0x4205053: ??? (in /lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3593== by 0x4205478: g_main_loop_run (in
/lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3593== by 0x8049AA6: main (main.c:171)
==3593== Address 0x47f3380 is 232 bytes inside a block of size 272 free'd
==3593== at 0x402A3A8: free (vg_replace_malloc.c:473)
==3593== by 0x42E7FD1: ??? (in /usr/lib/i386-linux-gnu/libtalloc.so.2.1.5)
==3593== by 0x804A3C4: call_leg_release (call.c:83)
==3593== by 0x804A188: app_mncc_disconnected (app.c:48)
==3593== by 0x804B52D: close_connection (mncc.c:255)
==3593== by 0x804BCFA: mncc_rtp_send.constprop.13 (mncc.c:145)
==3593== by 0x804CC86: check_setup (mncc.c:435)
==3593== by 0x804CC86: mncc_data (mncc.c:795)
==3593== by 0x42FCF94: osmo_fd_disp_fds (select.c:167)
==3593== by 0x804D1F2: evpoll (evpoll.c:92)
==3593== by 0x4205053: ??? (in /lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3593== by 0x4205478: g_main_loop_run (in
/lib/i386-linux-gnu/libglib-2.0.so.0.4200.1)
==3593== by 0x8049AA6: main (main.c:171)
Change-Id: I2e8e14b3983f84c9be046bbd96bbcd1e5766993e
-----------------------------------------------------------------------
Summary of changes:
src/app.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
hooks/post-receive
--
MNCC <-> SIP bridge