Closing stream after RTPForward call leads to Segmentation Fault

[mayamalkoti-ashmar]

Hello,
Janus is providing Segmentation fault (core dumped) error when a user session refreshes or when any publisher(including screen-share of any user) leaves the call after sending RTPForward request for any user via admin api to the janus server. The error log can be found below. Shall I increase debug level or perhaps try debugging using this https://janus.conf.meetecho.com/docs/debug in order to provide a more elaborate picture/nature of this error. Please help.

Janus-gdb-trace.txt
Janus-Sanitizer-Trace.-Error.txt

[tmatth]

From the line numbers this doesn't seem like master, what version are you using?

[mayamalkoti-ashmar]

I am using multistream branch. And my version is - v0.11.4

[atoppi]

@mayamalkoti-ashmar

1. Are the rtp_forward request and publisher leaving concurrent operations?
2. Could you try the same scenario by sending the rtp_forward request through the Janus API (and not the Admin) ?

[atoppi]

Never mind, I've been able to reproduce the crash by creating a forwarder through a js snippet

sfutest.send({ message: { request: "rtp_forward", room: 1234,  publisher_id: 1315327861600291, host: "127.0.0.1", secret: "adminpwd", streams: [{mid: "0", port: 15000}] }});

And then stopping the publisher session.
So Admin API and race conditions are not involved here.

ASan does not detect any heap-use-after free, just a SIGSEGV due to invalid ptr

AddressSanitizer:DEADLYSIGNAL
=================================================================
==125506==ERROR: AddressSanitizer: SEGV on unknown address 0x00002a9d2948 (pc 0x7f90aef405d8 bp 0x7f90a9a03d30 sp 0x7f90a9a03c10 T21)
==125506==The signal is caused by a READ memory access.
    #0 0x7f90aef405d7 in janus_videoroom_publisher_destroy plugins/janus_videoroom.c:2229
    #1 0x7f90aef65856 in janus_videoroom_destroy_session plugins/janus_videoroom.c:3692
    #2 0x55c54a6ab0b9 in janus_ice_outgoing_traffic_handle /home/atoppi/src/janus-gateway/ice.c:3990
    #3 0x55c54a64b178 in janus_ice_outgoing_traffic_dispatch /home/atoppi/src/janus-gateway/ice.c:421
    #4 0x7f90b8b5217c in g_main_dispatch ../../../glib/gmain.c:3309
    #5 0x7f90b8b5217c in g_main_context_dispatch ../../../glib/gmain.c:3974
    #6 0x7f90b8b523ff in g_main_context_iterate ../../../glib/gmain.c:4047
    #7 0x7f90b8b526f2 in g_main_loop_run ../../../glib/gmain.c:4241
    #8 0x55c54a6635b2 in janus_ice_handle_thread /home/atoppi/src/janus-gateway/ice.c:1219
    #9 0x7f90b8b7bad0 in g_thread_proxy ../../../glib/gthread.c:807
    #10 0x7f90b8527608 in start_thread /build/glibc-YbNSs7/glibc-2.31/nptl/pthread_create.c:477
    #11 0x7f90b844e292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

[atoppi]

The above commit should fix the issue, please test and report.

[mayamalkoti-ashmar]

Ok

[lminiero]

We didn't receive any feedback, so I'll assume the fix worked. Closing.