Re: [Linphone-developers] /0 bug in ortp

[Yuri Arabadji]

Hello.

Yep.

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0x7fffe7fff700 (LWP 6423)]
0x00007ffff775e9e6 in jitter_control_set_payload (ctl=0x88b480, pt=0x9f36d0) at 
jitterctl.c:62
62              ctl->corrective_step=(160 * 8000 )/pt->clock_rate; /* This 
formula got to me after some beers */

(gdb) bt
#0  0x00007ffff775e9e6 in jitter_control_set_payload (ctl=0x88b480, 
pt=0x9f36d0) at jitterctl.c:62
#1  0x00007ffff77595c8 in payload_type_changed (session=0x88af00, pt=0x9f36d0) 
at rtpsession.c:49
#2  0x00007ffff775a69c in rtp_session_update_payload_type (session=0x88af00, 
paytype=112) at rtpsession.c:608
#3  0x00007ffff77592ab in rtp_session_rtp_parse (session=0x88af00, 
mp=0x7fffe8005500, local_str_ts=127680, addr=0x7fffe7ffec60, addrlen=16) at 
rtpparse.c:200
#4  0x00007ffff775e480 in rtp_session_rtp_recv (session=0x88af00, 
user_ts=127680) at rtpsession_inet.c:992
#5  0x00007ffff775af9e in rtp_session_recvm_with_ts (session=0x88af00, 
user_ts=127680) at rtpsession.c:1006
#6  0x00007ffff7987368 in ?? () from /usr/lib/libmediastreamer.so.1
#7  0x00007ffff79847f6 in ms_filter_process () from 
/usr/lib/libmediastreamer.so.1
#8  0x00007ffff798553f in ?? () from /usr/lib/libmediastreamer.so.1
#9  0x00007ffff79855c8 in ?? () from /usr/lib/libmediastreamer.so.1
#10 0x00007ffff79859bf in ms_ticker_run () from /usr/lib/libmediastreamer.so.1
#11 0x00007ffff5db4537 in start_thread () from /lib/libpthread.so.0
#12 0x00007ffff5b247bd in clone () from /lib/libc.so.6

(gdb) p *ctl
$1 = {count = 0, jitt_comp = 60, jitt_comp_ts = 0, adapt_jitt_comp_ts = 1920, 
slide = 0, prev_slide = 0, jitter = 0, olddiff = 0, inter_jitter = 0, 
corrective_step = 40, corrective_slide = 0, 
  adaptive = 1 '\001', enabled = 1 '\001'}
(gdb) p *pt
$2 = {type = 8871712, clock_rate = 0, bits_per_sample = -16 '\360', 
zero_pattern = 0x7ffff62de540 "\320", <incomplete sequence \317>, 
pattern_length = 1, normal_bitrate = 0, mime_type = 0x65d7d0 "", 
  channels = 0, recv_fmtp = 0xac <Address 0xac out of bounds>, send_fmtp = 0x0, 
flags = 8131472, user_data = 0x0}
(gdb) f 1
#1  0x00007ffff77595c8 in payload_type_changed (session=0x88af00, pt=0x9f36d0) 
at rtpsession.c:49
49              jitter_control_set_payload(&session->rtp.jittctl,pt);
(gdb) p *session
$3 = {next = 0x0, mask_pos = 0, snd = {profile = 0x9f3140, pt = 99, ssrc = 
1240024518, wp = {lock = {__data = {__lock = 0, __count = 0, __owner = 0, 
__nusers = 0, __kind = 0, __spins = 0, __list = {
            __prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, 
__align = 0}, cond = {__data = {__lock = 0, __futex = 0, __total_seq = 0, 
__wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, 
          __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 
times>, __align = 0}, time = 0, wakeup = 0 '\000'}, telephone_events_pt = -1}, 
rcv = {profile = 0x9f3140, pt = 99, 
    ssrc = 3730246695, wp = {lock = {__data = {__lock = 0, __count = 0, __owner 
= 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 
0x0}}, __size = '\000' <repeats 39 times>, 
        __align = 0}, cond = {__data = {__lock = 0, __futex = 0, __total_seq = 
0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, 
__broadcast_seq = 0}, __size = '\000' <repeats 47 times>, 
        __align = 0}, time = 0, wakeup = 0 '\000'}, telephone_events_pt = -1}, 
inc_ssrc_candidate = 0, inc_same_ssrc_count = 0, hw_recv_pt = 112, 
recv_buf_size = 1500, on_ssrc_changed = {callback = {
      0x7ffff775bd09 <rtp_session_resync>, 0, 0, 0, 0}, user_data = {0, 0, 0, 
0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1ac "ssrc_changed", count = 
1}, on_payload_type_changed = {callback = {
      0x7ffff79914cd, 0, 0, 0, 0}, user_data = {8375392, 0, 0, 0, 0}, session = 
0x88af00, signal_name = 0x7ffff776c1b9 "payload_type_changed", count = 1}, 
on_telephone_event_packet = {callback = {0, 0, 0, 
      0, 0}, user_data = {0, 0, 0, 0, 0}, session = 0x88af00, signal_name = 
0x7ffff776c1de "telephone-event_packet", count = 0}, on_telephone_event = 
{callback = {0x7ffff7990a24, 0, 0, 0, 0}, user_data = {
      8375392, 0, 0, 0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1ce 
"telephone-event", count = 1}, on_timestamp_jump = {callback = {0x7ffff775bd09 
<rtp_session_resync>, 0, 0, 0, 0}, user_data = {
      0, 0, 0, 0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1f5 
"timestamp_jump", count = 1}, on_network_error = {callback = {0, 0, 0, 0, 0}, 
user_data = {0, 0, 0, 0, 0}, session = 0x88af00, 
    signal_name = 0x7ffff776c204 "network_error", count = 0}, on_rtcp_bye = 
{callback = {0, 0, 0, 0, 0}, user_data = {0, 0, 0, 0, 0}, session = 0x88af00, 
signal_name = 0x7ffff776c212 "rtcp_bye", 
    count = 0}, signal_tables = 0x88b900, eventqs = 0x86fe10, allocator = {q = 
{_q_stopper = {b_prev = 0x7fffe8006e70, b_next = 0x7fffe8006e70, b_cont = 0x0, 
b_datap = 0x0, b_rptr = 0x0, b_wptr = 0x0, 
        reserved1 = 0, reserved2 = 0}, q_mcount = 1}}, rtp = {socket = 13, tr = 
0x0, sockfamily = 2, max_rq_size = 100, time_jump = 5000, ts_jump = 160000, rq 
= {_q_stopper = {b_prev = 0x88b358, 
        b_next = 0x88b358, b_cont = 0x0, b_datap = 0x0, b_rptr = 0x0, b_wptr = 
0x0, reserved1 = 0, reserved2 = 0}, q_mcount = 0}, tev_rq = {_q_stopper = 
{b_prev = 0x88b398, b_next = 0x88b398, b_cont = 0x0, 
        b_datap = 0x0, b_rptr = 0x0, b_wptr = 0x0, reserved1 = 0, reserved2 = 
0}, q_mcount = 0}, cached_mp = 0x7fffe8005500, loc_port = 7080, rem_addr = 
{ss_family = 2, __ss_align = 0, 
      __ss_padding = '\000' <repeats 111 times>}, rem_addrlen = 16, QoSHandle = 
0x0, QoSFlowID = 0, jittctl = {count = 0, jitt_comp = 60, jitt_comp_ts = 0, 
adapt_jitt_comp_ts = 1920, slide = 0, 
      prev_slide = 0, jitter = 0, olddiff = 0, inter_jitter = 0, 
corrective_step = 40, corrective_slide = 0, adaptive = 1 '\001', enabled = 1 
'\001'}, snd_time_offset = 0, snd_ts_offset = 1280, 
    snd_rand_offset = 0, snd_last_ts = 128000, rcv_time_offset = 0, 
rcv_ts_offset = 0, rcv_query_ts_offset = 0, rcv_last_ts = 0, rcv_last_app_ts = 
127680, rcv_last_ret_ts = 0, hwrcv_extseq = 1, 
    hwrcv_seq_at_last_SR = 0, hwrcv_since_last_SR = 1, last_rcv_SR_ts = 0, 
last_rcv_SR_time = {tv_sec = 0, tv_usec = 0}, snd_seq = 199, 
last_rtcp_report_snt_r = 0, last_rtcp_report_snt_s = 0, 
    rtcp_report_snt_interval = 160000, last_rtcp_packet_count = 0, 
sent_payload_bytes = 12736, sent_bytes = 832, send_bw_start = {tv_sec = 
1306180584, tv_usec = 9856}, recv_bytes = 0, recv_bw_start = {
      tv_sec = 0, tv_usec = 0}, stats = {packet_sent = 199, sent = 15124, recv 
= 0, hw_recv = 122, packet_recv = 1, unavaillable = 399, outoftime = 0, 
cum_packet_loss = 0, bad = 0, discarded = 0}, 
    recv_errno = 0, send_errno = 0, snd_socket_size = 0, rcv_socket_size = 0, 
ssrc_changed_thres = 0}, rtcp = {socket = 14, sockfamily = 2, tr = 0x0, 
cached_mp = 0x7fffe8009320, rem_addr = {ss_family = 2, 
      __ss_align = 0, __ss_padding = '\000' <repeats 111 times>}, rem_addrlen = 
16, enabled = 1 '\001'}, mode = RTP_SESSION_SENDRECV, sched = 0x0, flags = 1, 
dscp = 0, multicast_ttl = 5, 
  multicast_loopback = 0, user_data = 0x0, last_recv_time = {tv_sec = 
1306180584, tv_usec = 149949}, pending = 0x0, current_tev = 0x0, sd = 0x9f7d60, 
contributing_sources = {_q_stopper = {
      b_prev = 0x88b6a0, b_next = 0x88b6a0, b_cont = 0x0, b_datap = 0x0, b_rptr 
= 0x0, b_wptr = 0x0, reserved1 = 0, reserved2 = 0}, q_mcount = 0}, 
symmetric_rtp = 1 '\001', permissive = 0 '\000', 
  use_connect = 0 '\000', ssrc_set = 1 '\001'}
(gdb) f 2
#2  0x00007ffff775a69c in rtp_session_update_payload_type (session=0x88af00, 
paytype=112) at rtpsession.c:608
608                     payload_type_changed(session,pt);
(gdb) f 3
#3  0x00007ffff77592ab in rtp_session_rtp_parse (session=0x88af00, 
mp=0x7fffe8005500, local_str_ts=127680, addr=0x7fffe7ffec60, addrlen=16) at 
rtpparse.c:200
200                     rtp_session_update_payload_type(session,rtp->paytype);
(gdb) p *mp
$4 = {b_prev = 0x0, b_next = 0x0, b_cont = 0x0, b_datap = 0x7fffe80089b0, 
b_rptr = 0x7fffe80089d0 "\200\360\001", 
  b_wptr = 0x7fffe8008a4a 
"099-192.168.40.72.dialog.cgatepro;lr>\r\nRecord-Route: 
<sip:192.168.40.72:5060;lr>\r\nRecord-Route: 
<sip:212.53.40.40:5060;lr>\r\nFrom: <sip:address@hidden>;tag=1187115752\r\nTo: 
<sip:address@hidden>;tag="..., reserved1 = 0, reserved2 = 0}
(gdb) p *addr
$5 = {sa_family = 2, sa_data = "H.\324\065(H\000\000\000\000\000\000\000"}


Tell me if you need anything else. You can get a free acc from sipnet.ru or I 
can provide you with one.

Thanks.


On Wednesday 18 May 2011, Simon Morlat wrote:
> HI,
> 
> Can you please show the full backtrace ?
> 
> 
> Simon
> 
> Le lundi 16 mai 2011 à 16:02 +0300, Yuri Arabadji a écrit :
> > Hi.
> >
> > Here you go:
> >
> > Program received signal SIGFPE, Arithmetic exception.
> > [Switching to Thread 0x7fffe7fff700 (LWP 21846)]
> > 0x00007ffff775ed7f in jitter_control_set_payload (ctl=0x8afe80,
> > pt=0xa0f900) at jitterctl.c:62
> >
> >
> > 59 void jitter_control_set_payload(JitterControl *ctl, PayloadType
> > *pt){
> >
> > 60 ctl->jitt_comp_ts =
> >
> > 61 (int) (((double) ctl->jitt_comp / 1000.0) * (pt->clock_rate));
> >
> > 62 ctl->corrective_step=(160 * 8000 )/pt->clock_rate; /* This formula
> > got to me after some beers */
> >
> > 63 ctl->adapt_jitt_comp_ts=ctl->jitt_comp_ts;
> >
> > 64 }
> >
> > (gdb) p pt->clock_rate
> >
> > $4 = 0
> >
> > Happening with speex/32000 and sipnet.ru.
> >

-- 
Best regards,
 Yuri Arabadji -- Systems Engineer