pjproject icon indicating copy to clipboard operation
pjproject copied to clipboard

Possible race between media deinitialization and media initialization

Open nanangizz opened this issue 9 months ago • 0 comments

A crash has been reported in destroying PJSUA with several concurrent calls, call stack trace is:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000028
Triggered by Thread:  0

Thread 0 Crashed:
0   (pjmedia_transport_simulate_lost + 28)
1   (call_media_init_cb + 168)
2   (call_media_init_cb + 168)
3   (ice_init_complete_cb + 252)
4   (timer_cb + 108)
5   (pj_timer_heap_poll + 616)
6   (pjsip_endpt_handle_events2 + 96)
7   (pjsua_handle_events + 84)
8   (busy_sleep + 88)
9   (pjsua_destroy2 + 1620)

Asynchronous ICE initialization callback seems to be invoked after the ICE transport is destroyed. As the ICE initialization callback is called by pjsua_destroy2() context (as shown in the stack trace above), simply adding media deinitialization check should be sufficient for this issue.

nanangizz avatar May 22 '24 07:05 nanangizz