crash in audio.c about baresip-android HOT 2 CLOSED

Forgot to mention that the crash happens after the call has been closed:

08-22 07:35:06.899 32601 32601 D Baresip : ua event (CALL_CLOSED) OK
08-22 07:35:06.904 32601 32619 D Baresip : sip:[email protected]: Call with sip:[email protected] terminated (duration: 4 sec)
08-22 07:35:06.907 32601 32618 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0xb5b5b5c1 in tid 32618 (Thread-2)

and does not happen with all calls. I have not seen it with calls over the same LAN, but only with some "long distance" calls that have longer delays and where signaling and audio go over different paths (audio involves media relay). This may mean that some audio packets arrive after the call has been closed and cause the crash.

from baresip-android.

I found from stackoverflow a function that can be used to test (on Android) if pointer is valid. I added the function (isValidPtr) to audio.c and used it to test le in audio.c/ aurx_stream_decode():

	/* Process exactly one audio-frame in reverse list order */
	for (le = rx->filtl.tail; le; le = le->prev) {
		struct aufilt_dec_st *st;
		if (isValidPtr(le, 4) == 0) {
			warning("audio: le is NOT valid pointer\n");
		} else {
			info("audio: le is valid pointer\n");
		}
		st = le->data;

And yes, when crash happens the pointer test fails:

08-23 10:26:09.945  3334  3361 D Baresip : sip:[email protected]: Call with sip:[email protected] terminated (duration: 1 sec)
08-23 10:26:09.950  3334  3361 D Baresip : audio: le is NOT valid pointer
08-23 10:26:09.951  3334  3360 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0xb5b5b5c1 in tid 3360 (Thread-2)

This seems to prove that the crash really happens in audio.c and that there is a bug somewhere in baresip code. I'll move this to issue to baresip-android to baresip, since I don't think that the bug is android specific.

from baresip-android.