Re: [Linphone-developers] /0 bug in ortp

[Simon Morlat]

Hi Yuri,

This is very surprising. It sounds like the PayloadType contents is
corrupted, however I have no idea why. It is certainly related to
something bad that occured before this crash.
Would you please send me a full linphone log ?

Regards,

Simon

Le lundi 23 mai 2011 à 23:04 +0300, Yuri Arabadji a écrit :
> Hello.
> 
> Yep.
> 
> Program received signal SIGFPE, Arithmetic exception.
> [Switching to Thread 0x7fffe7fff700 (LWP 6423)]
> 0x00007ffff775e9e6 in jitter_control_set_payload (ctl=0x88b480, pt=0x9f36d0) 
> at jitterctl.c:62
> 62              ctl->corrective_step=(160 * 8000 )/pt->clock_rate; /* This 
> formula got to me after some beers */
> 
> (gdb) bt
> #0  0x00007ffff775e9e6 in jitter_control_set_payload (ctl=0x88b480, 
> pt=0x9f36d0) at jitterctl.c:62
> #1  0x00007ffff77595c8 in payload_type_changed (session=0x88af00, 
> pt=0x9f36d0) at rtpsession.c:49
> #2  0x00007ffff775a69c in rtp_session_update_payload_type (session=0x88af00, 
> paytype=112) at rtpsession.c:608
> #3  0x00007ffff77592ab in rtp_session_rtp_parse (session=0x88af00, 
> mp=0x7fffe8005500, local_str_ts=127680, addr=0x7fffe7ffec60, addrlen=16) at 
> rtpparse.c:200
> #4  0x00007ffff775e480 in rtp_session_rtp_recv (session=0x88af00, 
> user_ts=127680) at rtpsession_inet.c:992
> #5  0x00007ffff775af9e in rtp_session_recvm_with_ts (session=0x88af00, 
> user_ts=127680) at rtpsession.c:1006
> #6  0x00007ffff7987368 in ?? () from /usr/lib/libmediastreamer.so.1
> #7  0x00007ffff79847f6 in ms_filter_process () from 
> /usr/lib/libmediastreamer.so.1
> #8  0x00007ffff798553f in ?? () from /usr/lib/libmediastreamer.so.1
> #9  0x00007ffff79855c8 in ?? () from /usr/lib/libmediastreamer.so.1
> #10 0x00007ffff79859bf in ms_ticker_run () from /usr/lib/libmediastreamer.so.1
> #11 0x00007ffff5db4537 in start_thread () from /lib/libpthread.so.0
> #12 0x00007ffff5b247bd in clone () from /lib/libc.so.6
> 
> (gdb) p *ctl
> $1 = {count = 0, jitt_comp = 60, jitt_comp_ts = 0, adapt_jitt_comp_ts = 1920, 
> slide = 0, prev_slide = 0, jitter = 0, olddiff = 0, inter_jitter = 0, 
> corrective_step = 40, corrective_slide = 0, 
>   adaptive = 1 '\001', enabled = 1 '\001'}
> (gdb) p *pt
> $2 = {type = 8871712, clock_rate = 0, bits_per_sample = -16 '\360', 
> zero_pattern = 0x7ffff62de540 "\320", <incomplete sequence \317>, 
> pattern_length = 1, normal_bitrate = 0, mime_type = 0x65d7d0 "", 
>   channels = 0, recv_fmtp = 0xac <Address 0xac out of bounds>, send_fmtp = 
> 0x0, flags = 8131472, user_data = 0x0}
> (gdb) f 1
> #1  0x00007ffff77595c8 in payload_type_changed (session=0x88af00, 
> pt=0x9f36d0) at rtpsession.c:49
> 49              jitter_control_set_payload(&session->rtp.jittctl,pt);
> (gdb) p *session
> $3 = {next = 0x0, mask_pos = 0, snd = {profile = 0x9f3140, pt = 99, ssrc = 
> 1240024518, wp = {lock = {__data = {__lock = 0, __count = 0, __owner = 0, 
> __nusers = 0, __kind = 0, __spins = 0, __list = {
>             __prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, 
> __align = 0}, cond = {__data = {__lock = 0, __futex = 0, __total_seq = 0, 
> __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, 
>           __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 
> times>, __align = 0}, time = 0, wakeup = 0 '\000'}, telephone_events_pt = 
> -1}, rcv = {profile = 0x9f3140, pt = 99, 
>     ssrc = 3730246695, wp = {lock = {__data = {__lock = 0, __count = 0, 
> __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, 
> __next = 0x0}}, __size = '\000' <repeats 39 times>, 
>         __align = 0}, cond = {__data = {__lock = 0, __futex = 0, __total_seq 
> = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, 
> __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, 
>         __align = 0}, time = 0, wakeup = 0 '\000'}, telephone_events_pt = 
> -1}, inc_ssrc_candidate = 0, inc_same_ssrc_count = 0, hw_recv_pt = 112, 
> recv_buf_size = 1500, on_ssrc_changed = {callback = {
>       0x7ffff775bd09 <rtp_session_resync>, 0, 0, 0, 0}, user_data = {0, 0, 0, 
> 0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1ac "ssrc_changed", count 
> = 1}, on_payload_type_changed = {callback = {
>       0x7ffff79914cd, 0, 0, 0, 0}, user_data = {8375392, 0, 0, 0, 0}, session 
> = 0x88af00, signal_name = 0x7ffff776c1b9 "payload_type_changed", count = 1}, 
> on_telephone_event_packet = {callback = {0, 0, 0, 
>       0, 0}, user_data = {0, 0, 0, 0, 0}, session = 0x88af00, signal_name = 
> 0x7ffff776c1de "telephone-event_packet", count = 0}, on_telephone_event = 
> {callback = {0x7ffff7990a24, 0, 0, 0, 0}, user_data = {
>       8375392, 0, 0, 0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1ce 
> "telephone-event", count = 1}, on_timestamp_jump = {callback = 
> {0x7ffff775bd09 <rtp_session_resync>, 0, 0, 0, 0}, user_data = {
>       0, 0, 0, 0, 0}, session = 0x88af00, signal_name = 0x7ffff776c1f5 
> "timestamp_jump", count = 1}, on_network_error = {callback = {0, 0, 0, 0, 0}, 
> user_data = {0, 0, 0, 0, 0}, session = 0x88af00, 
>     signal_name = 0x7ffff776c204 "network_error", count = 0}, on_rtcp_bye = 
> {callback = {0, 0, 0, 0, 0}, user_data = {0, 0, 0, 0, 0}, session = 0x88af00, 
> signal_name = 0x7ffff776c212 "rtcp_bye", 
>     count = 0}, signal_tables = 0x88b900, eventqs = 0x86fe10, allocator = {q 
> = {_q_stopper = {b_prev = 0x7fffe8006e70, b_next = 0x7fffe8006e70, b_cont = 
> 0x0, b_datap = 0x0, b_rptr = 0x0, b_wptr = 0x0, 
>         reserved1 = 0, reserved2 = 0}, q_mcount = 1}}, rtp = {socket = 13, tr 
> = 0x0, sockfamily = 2, max_rq_size = 100, time_jump = 5000, ts_jump = 160000, 
> rq = {_q_stopper = {b_prev = 0x88b358, 
>         b_next = 0x88b358, b_cont = 0x0, b_datap = 0x0, b_rptr = 0x0, b_wptr 
> = 0x0, reserved1 = 0, reserved2 = 0}, q_mcount = 0}, tev_rq = {_q_stopper = 
> {b_prev = 0x88b398, b_next = 0x88b398, b_cont = 0x0, 
>         b_datap = 0x0, b_rptr = 0x0, b_wptr = 0x0, reserved1 = 0, reserved2 = 
> 0}, q_mcount = 0}, cached_mp = 0x7fffe8005500, loc_port = 7080, rem_addr = 
> {ss_family = 2, __ss_align = 0, 
>       __ss_padding = '\000' <repeats 111 times>}, rem_addrlen = 16, QoSHandle 
> = 0x0, QoSFlowID = 0, jittctl = {count = 0, jitt_comp = 60, jitt_comp_ts = 0, 
> adapt_jitt_comp_ts = 1920, slide = 0, 
>       prev_slide = 0, jitter = 0, olddiff = 0, inter_jitter = 0, 
> corrective_step = 40, corrective_slide = 0, adaptive = 1 '\001', enabled = 1 
> '\001'}, snd_time_offset = 0, snd_ts_offset = 1280, 
>     snd_rand_offset = 0, snd_last_ts = 128000, rcv_time_offset = 0, 
> rcv_ts_offset = 0, rcv_query_ts_offset = 0, rcv_last_ts = 0, rcv_last_app_ts 
> = 127680, rcv_last_ret_ts = 0, hwrcv_extseq = 1, 
>     hwrcv_seq_at_last_SR = 0, hwrcv_since_last_SR = 1, last_rcv_SR_ts = 0, 
> last_rcv_SR_time = {tv_sec = 0, tv_usec = 0}, snd_seq = 199, 
> last_rtcp_report_snt_r = 0, last_rtcp_report_snt_s = 0, 
>     rtcp_report_snt_interval = 160000, last_rtcp_packet_count = 0, 
> sent_payload_bytes = 12736, sent_bytes = 832, send_bw_start = {tv_sec = 
> 1306180584, tv_usec = 9856}, recv_bytes = 0, recv_bw_start = {
>       tv_sec = 0, tv_usec = 0}, stats = {packet_sent = 199, sent = 15124, 
> recv = 0, hw_recv = 122, packet_recv = 1, unavaillable = 399, outoftime = 0, 
> cum_packet_loss = 0, bad = 0, discarded = 0}, 
>     recv_errno = 0, send_errno = 0, snd_socket_size = 0, rcv_socket_size = 0, 
> ssrc_changed_thres = 0}, rtcp = {socket = 14, sockfamily = 2, tr = 0x0, 
> cached_mp = 0x7fffe8009320, rem_addr = {ss_family = 2, 
>       __ss_align = 0, __ss_padding = '\000' <repeats 111 times>}, rem_addrlen 
> = 16, enabled = 1 '\001'}, mode = RTP_SESSION_SENDRECV, sched = 0x0, flags = 
> 1, dscp = 0, multicast_ttl = 5, 
>   multicast_loopback = 0, user_data = 0x0, last_recv_time = {tv_sec = 
> 1306180584, tv_usec = 149949}, pending = 0x0, current_tev = 0x0, sd = 
> 0x9f7d60, contributing_sources = {_q_stopper = {
>       b_prev = 0x88b6a0, b_next = 0x88b6a0, b_cont = 0x0, b_datap = 0x0, 
> b_rptr = 0x0, b_wptr = 0x0, reserved1 = 0, reserved2 = 0}, q_mcount = 0}, 
> symmetric_rtp = 1 '\001', permissive = 0 '\000', 
>   use_connect = 0 '\000', ssrc_set = 1 '\001'}
> (gdb) f 2
> #2  0x00007ffff775a69c in rtp_session_update_payload_type (session=0x88af00, 
> paytype=112) at rtpsession.c:608
> 608                     payload_type_changed(session,pt);
> (gdb) f 3
> #3  0x00007ffff77592ab in rtp_session_rtp_parse (session=0x88af00, 
> mp=0x7fffe8005500, local_str_ts=127680, addr=0x7fffe7ffec60, addrlen=16) at 
> rtpparse.c:200
> 200                     rtp_session_update_payload_type(session,rtp->paytype);
> (gdb) p *mp
> $4 = {b_prev = 0x0, b_next = 0x0, b_cont = 0x0, b_datap = 0x7fffe80089b0, 
> b_rptr = 0x7fffe80089d0 "\200\360\001", 
>   b_wptr = 0x7fffe8008a4a 
> "099-192.168.40.72.dialog.cgatepro;lr>\r\nRecord-Route: 
> <sip:192.168.40.72:5060;lr>\r\nRecord-Route: 
> <sip:212.53.40.40:5060;lr>\r\nFrom: 
> <sip:address@hidden>;tag=1187115752\r\nTo: 
> <sip:address@hidden>;tag="..., reserved1 = 0, reserved2 = 0}
> (gdb) p *addr
> $5 = {sa_family = 2, sa_data = "H.\324\065(H\000\000\000\000\000\000\000"}
> 
> 
> Tell me if you need anything else. You can get a free acc from sipnet.ru or I 
> can provide you with one.
> 
> Thanks.
> 
> 
> On Wednesday 18 May 2011, Simon Morlat wrote:
> > HI,
> > 
> > Can you please show the full backtrace ?
> > 
> > 
> > Simon
> > 
> > Le lundi 16 mai 2011 à 16:02 +0300, Yuri Arabadji a écrit :
> > > Hi.
> > >
> > > Here you go:
> > >
> > > Program received signal SIGFPE, Arithmetic exception.
> > > [Switching to Thread 0x7fffe7fff700 (LWP 21846)]
> > > 0x00007ffff775ed7f in jitter_control_set_payload (ctl=0x8afe80,
> > > pt=0xa0f900) at jitterctl.c:62
> > >
> > >
> > > 59 void jitter_control_set_payload(JitterControl *ctl, PayloadType
> > > *pt){
> > >
> > > 60 ctl->jitt_comp_ts =
> > >
> > > 61 (int) (((double) ctl->jitt_comp / 1000.0) * (pt->clock_rate));
> > >
> > > 62 ctl->corrective_step=(160 * 8000 )/pt->clock_rate; /* This formula
> > > got to me after some beers */
> > >
> > > 63 ctl->adapt_jitt_comp_ts=ctl->jitt_comp_ts;
> > >
> > > 64 }
> > >
> > > (gdb) p pt->clock_rate
> > >
> > > $4 = 0
> > >
> > > Happening with speex/32000 and sipnet.ru.
> > >
>