Hello,
There may be one heap-use-after-free while calling
RTPInterface::sendDataOverTCP. The following is the bug report from the ASAN:
----
==17==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000f3a0e8 at
pc 0x0000005d5ec8 bp 0x7ffff35fc420 sp 0x7ffff35fc418
READ of size 1 at 0x62e000f3a0e8 thread T0
#0 0x5d5ec7 in RTPInterface::sendDataOverTCP(int, TLSState*, unsigned char
const*, unsigned int, unsigned char) /home/ubuntu/experiments/live/liveMedia
/RTPInterface.cpp:394:51
#1 0x5d4296 in RTPInterface::sendRTPorRTCPPacketOverTCP(unsigned char*,
unsigned int, int, unsigned char, TLSState*) /home/ubuntu/experiments/live/live
Media/RTPInterface.cpp:371:10
#2 0x5d4296 in RTPInterface::sendPacket(unsigned char*, unsigned int)
/home/ubuntu/experiments/live/liveMedia/RTPInterface.cpp:254:10
#3 0x5d1188 in MultiFramedRTPSink::sendPacketIfNecessary()
/home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:395:21
#4 0x5d07d1 in MultiFramedRTPSink::afterGettingFrame1(unsigned int,
unsigned int, timeval, unsigned int)
/home/ubuntu/experiments/live/liveMedia/MultiF
ramedRTPSink.cpp
#5 0x5fa8b9 in MatroskaFileParser::parse()
/home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:191:4
#6 0x5f90ba in MatroskaFileParser::continueParsing()
/home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:118:10
#7 0x5cf854 in MultiFramedRTPSink::packFrame()
/home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:223:14
#8 0x653902 in AlarmHandler::handleTimeout()
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:34:5
#9 0x64a06c in BasicTaskScheduler::SingleStep(unsigned int)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:212:15
#10 0x6522ea in BasicTaskScheduler0::doEventLoop(char volatile*)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5
#11 0x4ccec4 in main
/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24
0x62e000f3a0e8 is located 40168 bytes inside of 40328-byte region
[0x62e000f30400,0x62e000f3a188)
freed by thread T0 here:
#0 0x4c80fd in operator delete(void*)
(/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c80fd)
#1 0x4dccb0 in RTSPServer::RTSPClientConnection::handleRequestBytes(int)
/home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:1014:51
#2 0x5d6a3a in SocketDescriptor::~SocketDescriptor()
/home/ubuntu/experiments/live/liveMedia/RTPInterface.cpp:476:5
#3 0x5d6c78 in SocketDescriptor::~SocketDescriptor()
/home/ubuntu/experiments/live/liveMedia/RTPInterface.cpp:447:39
#4 0x649d1c in BasicTaskScheduler::SingleStep(unsigned int)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:153:7
#5 0x6522ea in BasicTaskScheduler0::doEventLoop(char volatile*)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5
#6 0x4ccec4 in main
/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24
previously allocated by thread T0 here:
#0 0x4c789d in operator new(unsigned long)
(/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c789d)
#1 0x4e4955 in RTSPServer::createNewClientConnection(int, sockaddr_storage
const&) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:2031:10
#2 0x5e5a92 in GenericMediaServer::incomingConnectionHandlerOnSocket(int)
/home/ubuntu/experiments/live/liveMedia/GenericMediaServer.cpp:251:9
#3 0x649d1c in BasicTaskScheduler::SingleStep(unsigned int)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:153:7
#4 0x6522ea in BasicTaskScheduler0::doEventLoop(char volatile*)
/home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5
#5 0x4ccec4 in main
/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24
SUMMARY: AddressSanitizer: heap-use-after-free
/home/ubuntu/experiments/live/liveMedia/RTPInterface.cpp:394:51 in
RTPInterface::sendDataOverTCP(int, TLSSta
te*, unsigned char const*, unsigned int, unsigned char)
Shadow bytes around the buggy address:
0x0c5c801df3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5c801df3d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5c801df3e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5c801df3f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5c801df400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c5c801df410: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
0x0c5c801df420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5c801df430: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5c801df440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5c801df450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5c801df460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==17==ABORTING
------
Kind Regards,
Ruijie
_______________________________________________
live-devel mailing list
live-devel@lists.live555.com
http://lists.live555.com/mailman/listinfo/live-devel
