Benoit Panizzon
2022-Aug-23 15:29 UTC
[asterisk-users] Asterisk 16.16.1 crash upon receiving image 0 udptl t38 sdp
Hi List I can reproduce Asterisk 16.16.1 segfaulting in this situation: Asterisk configured with Application "ReceiveFax". Incoming call with SDP: v=0 o=prt-cbl-sbc1 1418830458 1418830459 IN IP4 157.161.X.X s=sip call c=IN IP4 157.161.X.X t=0 0 m=audio 11828 RTP/AVP 9 8 101 a=rtpmap:9 g722/8000 a=rtpmap:8 pcma/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv a=ptime:20 Asterisk Answering to Invite with 200 OK + SDP v=0 o=prt-cbl-sbc1 1418830458 1418830461 IN IP4 157.161.X.X s=sip call c=IN IP4 157.161.X.X t=0 0 m=audio 11830 RTP/AVP 8 101 a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=ptime:20 a=maxptime:150 a=sendrecv ReceiveFax invoking Re-Invite to t38: v=0 o=prt-cbl-sbc1 1418830458 1418830462 IN IP4 157.161.X.X s=sip call c=IN IP4 157.161.X.X t=0 0 m=image 11830 udptl t38 a=sendrecv a=T38FaxVersion:0 a=T38MaxBitRate:14400 a=T38FaxRateManagement:transferredTCF a=T38FaxMaxDatagram:425 Caller telling. I am unable to do t38 by setting image port to zero in 200 OK + SDP reply to T38 Invite: v=0 o=prt-cbl-sbc1 1418830458 1418830460 IN IP4 157.161.10.229 s=sip call c=IN IP4 157.161.10.254 t=0 0 m=image 0 udptl t38 a=sendrecv I have found a Snom M9 and a Grandstream Phone behaving that way. Upon receiving that 200 OK + SDP Asterisk is segfaulting! Has anyone else observed said issue? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________
Joshua C. Colp
2022-Aug-23 15:34 UTC
[asterisk-users] Asterisk 16.16.1 crash upon receiving image 0 udptl t38 sdp
On Tue, Aug 23, 2022 at 12:30 PM Benoit Panizzon <benoit.panizzon at imp.ch> wrote:> Hi List > > I can reproduce Asterisk 16.16.1 segfaulting in this situation: > > Asterisk configured with Application "ReceiveFax". > > Incoming call with SDP: > > v=0 > o=prt-cbl-sbc1 1418830458 1418830459 IN IP4 157.161.X.X > s=sip call > c=IN IP4 157.161.X.X > t=0 0 > m=audio 11828 RTP/AVP 9 8 101 > a=rtpmap:9 g722/8000 > a=rtpmap:8 pcma/8000 > a=rtpmap:101 telephone-event/8000 > a=fmtp:101 0-15 > a=sendrecv > a=ptime:20 > > Asterisk Answering to Invite with 200 OK + SDP > > v=0 > o=prt-cbl-sbc1 1418830458 1418830461 IN IP4 157.161.X.X > s=sip call > c=IN IP4 157.161.X.X > t=0 0 > m=audio 11830 RTP/AVP 8 101 > a=rtpmap:8 PCMA/8000 > a=rtpmap:101 telephone-event/8000 > a=fmtp:101 0-16 > a=ptime:20 > a=maxptime:150 > a=sendrecv > > ReceiveFax invoking Re-Invite to t38: > > v=0 > o=prt-cbl-sbc1 1418830458 1418830462 IN IP4 157.161.X.X > s=sip call > c=IN IP4 157.161.X.X > t=0 0 > m=image 11830 udptl t38 > a=sendrecv > a=T38FaxVersion:0 > a=T38MaxBitRate:14400 > a=T38FaxRateManagement:transferredTCF > a=T38FaxMaxDatagram:425 > > Caller telling. I am unable to do t38 by setting image port to zero in > 200 OK + SDP reply to T38 Invite: > > v=0 > o=prt-cbl-sbc1 1418830458 1418830460 IN IP4 157.161.10.229 > s=sip call > c=IN IP4 157.161.10.254 > t=0 0 > m=image 0 udptl t38 > a=sendrecv > > I have found a Snom M9 and a Grandstream Phone behaving that way. > > Upon receiving that 200 OK + SDP Asterisk is segfaulting! > > Has anyone else observed said issue? >This was a security issue[1] which was solved. [1] https://downloads.asterisk.org/pub/security/AST-2021-006.html -- Joshua C. Colp Asterisk Project Lead Sangoma Technologies Check us out at www.sangoma.com and www.asterisk.org -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20220823/2cebf63b/attachment.html>