srtp: heap-use-after-free rekeying test bug about baresip HOT 5 CLOSED

Because of these lines

    #2 0x7fbcecd2c487 in thread_create_name /home/runner/work/baresip/baresip/re/src/thread/thread.c:125:8
    #3 0x55d4b9183e26 in rtprecv_start_thread /home/runner/work/baresip/baresip/src/rtprecv.c:770:8

I guess the cause is a combination of re-keying and RX thread. @cHuberCoffee and me will try to find a solution.

from baresip.

I was aware of the possibility of such a problem, but i thought the thread sanitizer would catch it quickly.
It sounds like the RX thread uses key material and methods (udp helpers) while the main thread has to rekey which is a free on the underlying structure. A proper locking should fix the issue.
I'm working on it.

from baresip.

Thanks!

from baresip.

The origin of the problem described here is different. Its the rather brutal way i forced a change of the tx keys by removing the hole strm->mes = mem_deref(strm->mes);.
I have to check for a better way to exchange the tx keys without touching the rx parts.

As i'm not able to find a quick solution today, i would suggest to deactivate the testcase and i work on the fix.

from baresip.

#3013 for now.

from baresip.