SIGSEGV when receving rtcp with not known ssrc

[j-licht]

I've got this Segmentation Fault, when I restart my sender fast and keep the receiver running. Then the receiver sending feedback with for a SSRC from the old session.

#0 0x00007ffff2dad58c in ScreamTx::Stream::isRtpQueueDiscard (this=0x0) at ScreamTx.cpp:2008 #1 0x00007ffff2dac990 in ScreamTx::Stream::getTargetBitrate (this=0x0) at ScreamTx.cpp:1749 #2 0x00007ffff2da987f in ScreamTx::getTargetBitrate (this=0x5555559aa330, ssrc=3462544249) at ScreamTx.cpp:885 #3 0x00007ffff2da6327 in on_receiving_rtcp (session=0x555555bc61a0, buffer=0x7fffdc0279a0, early=1436201072, object=0x7ffff0eec030) at gstgscreamtx.cpp:307

My hotfix is to return 0 in ScreamTx::Stream::getTargetBitrate if I couldn't find the stream by SSRC.

[j-licht]

I think it's also the Problem, that the Sender cannot handle the feedback, if it contains more Media SSRC and the first one isn't the Sender's SSRC.

[IngJohEricsson]

Hi

Thanks for the bugreport.

The receiver code has a feature that resets itself and wipes away all “old” SSRCs if RTP packets have not been received the last two seconds.

https://github.com/EricssonResearch/scream/blob/master/code/gscream/gst-gscreamrx/gst-plugin/src/gstgscreamrx.cpp#L512 https://github.com/EricssonResearch/scream/blob/master/code/gscream/gst-gscreamrx/gst-plugin/src/gstgscreamrx.cpp#L512

This means that if the sender pipeline is restarted within 2s then you will have an old SSRC reported in the feedback, along with the new. A better fix would be to ignore feedback for unknown SSRCs in the sender code. I will try to fix this.

/Ingemar

From: j-licht [email protected] Sent: den 17 juni 2019 15:59 To: EricssonResearch/scream [email protected] Cc: Subscribed [email protected] Subject: [EricssonResearch/scream] SIGSEGV when receving rtcp with not known ssrc (#19)

I've got this Segmentation Fault, when I restart my sender fast and keep the receiver running. Then the receiver sending feedback with for a SSRC from the old session.

#0 0x00007ffff2dad58c in ScreamTx::Stream::isRtpQueueDiscard (this=0x0) at ScreamTx.cpp:2008 #1 https://protect2.fireeye.com/url?k=1d8bc0f2-415fccac-1d8b8069-8691959ed9b7-9b244b86d4b6766b&q=1&u=https%3A%2F%2Fgithub.com%2FEricssonResearch%2Fscream%2Fpull%2F1 0x00007ffff2dac990 in ScreamTx::Stream::getTargetBitrate (this=0x0) at ScreamTx.cpp:1749 #2 https://protect2.fireeye.com/url?k=a12e8b50-fdfa870e-a12ecbcb-8691959ed9b7-e140ba03cacd8a71&q=1&u=https%3A%2F%2Fgithub.com%2FEricssonResearch%2Fscream%2Fpull%2F2 0x00007ffff2da987f in ScreamTx::getTargetBitrate (this=0x5555559aa330, ssrc=3462544249) at ScreamTx.cpp:885 #3 https://protect2.fireeye.com/url?k=18a66a7d-44726623-18a62ae6-8691959ed9b7-99c455da260ac495&q=1&u=https%3A%2F%2Fgithub.com%2FEricssonResearch%2Fscream%2Fpull%2F3 0x00007ffff2da6327 in on_receiving_rtcp (session=0x555555bc61a0, buffer=0x7fffdc0279a0, early=1436201072, object=0x7ffff0eec030) at gstgscreamtx.cpp:307

My hotfix is to return 0 in ScreamTx::Stream::getTargetBitrate if I couldn't find the stream by SSRC.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://protect2.fireeye.com/url?k=e843e92d-b497e573-e843a9b6-8691959ed9b7-3d9a707b8821df78&q=1&u=https%3A%2F%2Fgithub.com%2FEricssonResearch%2Fscream%2Fissues%2F19%3Femail_source%3Dnotifications%26email_token%3DACRZ2GBO5WWW67XSQ6RPRXDP26KCZA5CNFSM4HYW5MX2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4GZ4QZOQ , or mute the thread https://protect2.fireeye.com/url?k=063a790a-5aee7554-063a3991-8691959ed9b7-c85df9d823872cf6&q=1&u=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FACRZ2GDNXQJZ3BCCXNTN7SLP26KCZANCNFSM4HYW5MXQ .